xref: /freebsd/sys/contrib/dev/mediatek/mt76/mt76_connac_mcu.c (revision ebacd8013fe5f7fdf9f6a5b286f6680dd2891036)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include "mt76_connac2_mac.h"
6 #include "mt76_connac_mcu.h"
7 
8 int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
9 {
10 	struct {
11 		__le32 option;
12 		__le32 addr;
13 	} req = {
14 		.option = cpu_to_le32(option),
15 		.addr = cpu_to_le32(addr),
16 	};
17 
18 	return mt76_mcu_send_msg(dev, MCU_CMD(FW_START_REQ), &req,
19 				 sizeof(req), true);
20 }
21 EXPORT_SYMBOL_GPL(mt76_connac_mcu_start_firmware);
22 
23 int mt76_connac_mcu_patch_sem_ctrl(struct mt76_dev *dev, bool get)
24 {
25 	u32 op = get ? PATCH_SEM_GET : PATCH_SEM_RELEASE;
26 	struct {
27 		__le32 op;
28 	} req = {
29 		.op = cpu_to_le32(op),
30 	};
31 
32 	return mt76_mcu_send_msg(dev, MCU_CMD(PATCH_SEM_CONTROL),
33 				 &req, sizeof(req), true);
34 }
35 EXPORT_SYMBOL_GPL(mt76_connac_mcu_patch_sem_ctrl);
36 
37 int mt76_connac_mcu_start_patch(struct mt76_dev *dev)
38 {
39 	struct {
40 		u8 check_crc;
41 		u8 reserved[3];
42 	} req = {
43 		.check_crc = 0,
44 	};
45 
46 	return mt76_mcu_send_msg(dev, MCU_CMD(PATCH_FINISH_REQ),
47 				 &req, sizeof(req), true);
48 }
49 EXPORT_SYMBOL_GPL(mt76_connac_mcu_start_patch);
50 
51 #define MCU_PATCH_ADDRESS	0x200000
52 
53 int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
54 				  u32 mode)
55 {
56 	struct {
57 		__le32 addr;
58 		__le32 len;
59 		__le32 mode;
60 	} req = {
61 		.addr = cpu_to_le32(addr),
62 		.len = cpu_to_le32(len),
63 		.mode = cpu_to_le32(mode),
64 	};
65 	int cmd;
66 
67 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
68 	    (is_mt7921(dev) && addr == 0x900000))
69 		cmd = MCU_CMD(PATCH_START_REQ);
70 	else
71 		cmd = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
72 
73 	return mt76_mcu_send_msg(dev, cmd, &req, sizeof(req), true);
74 }
75 EXPORT_SYMBOL_GPL(mt76_connac_mcu_init_download);
76 
77 int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy)
78 {
79 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
80 	struct mt76_connac_mcu_channel_domain {
81 		u8 alpha2[4]; /* regulatory_request.alpha2 */
82 		u8 bw_2g; /* BW_20_40M		0
83 			   * BW_20M		1
84 			   * BW_20_40_80M	2
85 			   * BW_20_40_80_160M	3
86 			   * BW_20_40_80_8080M	4
87 			   */
88 		u8 bw_5g;
89 		u8 bw_6g;
90 		u8 pad;
91 		u8 n_2ch;
92 		u8 n_5ch;
93 		u8 n_6ch;
94 		u8 pad2;
95 	} __packed hdr = {
96 		.bw_2g = 0,
97 		.bw_5g = 3, /* BW_20_40_80_160M */
98 		.bw_6g = 3,
99 	};
100 	struct mt76_connac_mcu_chan {
101 		__le16 hw_value;
102 		__le16 pad;
103 		__le32 flags;
104 	} __packed channel;
105 	struct mt76_dev *dev = phy->dev;
106 	struct ieee80211_channel *chan;
107 	struct sk_buff *skb;
108 
109 	n_max_channels = phy->sband_2g.sband.n_channels +
110 			 phy->sband_5g.sband.n_channels +
111 			 phy->sband_6g.sband.n_channels;
112 	len = sizeof(hdr) + n_max_channels * sizeof(channel);
113 
114 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
115 	if (!skb)
116 		return -ENOMEM;
117 
118 	skb_reserve(skb, sizeof(hdr));
119 
120 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
121 		chan = &phy->sband_2g.sband.channels[i];
122 		if (chan->flags & IEEE80211_CHAN_DISABLED)
123 			continue;
124 
125 		channel.hw_value = cpu_to_le16(chan->hw_value);
126 		channel.flags = cpu_to_le32(chan->flags);
127 		channel.pad = 0;
128 
129 		skb_put_data(skb, &channel, sizeof(channel));
130 		n_2ch++;
131 	}
132 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
133 		chan = &phy->sband_5g.sband.channels[i];
134 		if (chan->flags & IEEE80211_CHAN_DISABLED)
135 			continue;
136 
137 		channel.hw_value = cpu_to_le16(chan->hw_value);
138 		channel.flags = cpu_to_le32(chan->flags);
139 		channel.pad = 0;
140 
141 		skb_put_data(skb, &channel, sizeof(channel));
142 		n_5ch++;
143 	}
144 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
145 		chan = &phy->sband_6g.sband.channels[i];
146 		if (chan->flags & IEEE80211_CHAN_DISABLED)
147 			continue;
148 
149 		channel.hw_value = cpu_to_le16(chan->hw_value);
150 		channel.flags = cpu_to_le32(chan->flags);
151 		channel.pad = 0;
152 
153 		skb_put_data(skb, &channel, sizeof(channel));
154 		n_6ch++;
155 	}
156 
157 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(hdr.alpha2));
158 	memcpy(hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
159 	hdr.n_2ch = n_2ch;
160 	hdr.n_5ch = n_5ch;
161 	hdr.n_6ch = n_6ch;
162 
163 	memcpy(__skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
164 
165 	return mt76_mcu_skb_send_msg(dev, skb, MCU_CE_CMD(SET_CHAN_DOMAIN),
166 				     false);
167 }
168 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_channel_domain);
169 
170 int mt76_connac_mcu_set_mac_enable(struct mt76_dev *dev, int band, bool enable,
171 				   bool hdr_trans)
172 {
173 	struct {
174 		u8 enable;
175 		u8 band;
176 		u8 rsv[2];
177 	} __packed req_mac = {
178 		.enable = enable,
179 		.band = band,
180 	};
181 
182 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(MAC_INIT_CTRL), &req_mac,
183 				 sizeof(req_mac), true);
184 }
185 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_mac_enable);
186 
187 int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
188 {
189 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
190 	struct {
191 		u8 bss_idx;
192 		u8 ps_state; /* 0: device awake
193 			      * 1: static power save
194 			      * 2: dynamic power saving
195 			      */
196 	} req = {
197 		.bss_idx = mvif->idx,
198 		.ps_state = vif->cfg.ps ? 2 : 0,
199 	};
200 
201 	if (vif->type != NL80211_IFTYPE_STATION)
202 		return -EOPNOTSUPP;
203 
204 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(SET_PS_PROFILE),
205 				 &req, sizeof(req), false);
206 }
207 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_vif_ps);
208 
209 int mt76_connac_mcu_set_rts_thresh(struct mt76_dev *dev, u32 val, u8 band)
210 {
211 	struct {
212 		u8 prot_idx;
213 		u8 band;
214 		u8 rsv[2];
215 		__le32 len_thresh;
216 		__le32 pkt_thresh;
217 	} __packed req = {
218 		.prot_idx = 1,
219 		.band = band,
220 		.len_thresh = cpu_to_le32(val),
221 		.pkt_thresh = cpu_to_le32(0x2),
222 	};
223 
224 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(PROTECT_CTRL), &req,
225 				 sizeof(req), true);
226 }
227 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_rts_thresh);
228 
229 void mt76_connac_mcu_beacon_loss_iter(void *priv, u8 *mac,
230 				      struct ieee80211_vif *vif)
231 {
232 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
233 	struct mt76_connac_beacon_loss_event *event = priv;
234 
235 	if (mvif->idx != event->bss_idx)
236 		return;
237 
238 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
239 		return;
240 
241 	ieee80211_beacon_loss(vif);
242 }
243 EXPORT_SYMBOL_GPL(mt76_connac_mcu_beacon_loss_iter);
244 
245 struct tlv *
246 mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
247 			       void *sta_ntlv, void *sta_wtbl)
248 {
249 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
250 	struct tlv *sta_hdr = sta_wtbl;
251 	struct tlv *ptlv, tlv = {
252 		.tag = cpu_to_le16(tag),
253 		.len = cpu_to_le16(len),
254 	};
255 	u16 ntlv;
256 
257 	ptlv = skb_put(skb, len);
258 	memcpy(ptlv, &tlv, sizeof(tlv));
259 
260 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
261 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
262 
263 	if (sta_hdr) {
264 		len += le16_to_cpu(sta_hdr->len);
265 		sta_hdr->len = cpu_to_le16(len);
266 	}
267 
268 	return ptlv;
269 }
270 EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_nested_tlv);
271 
272 struct sk_buff *
273 __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
274 				struct mt76_wcid *wcid, int len)
275 {
276 	struct sta_req_hdr hdr = {
277 		.bss_idx = mvif->idx,
278 		.muar_idx = wcid ? mvif->omac_idx : 0,
279 		.is_tlv_append = 1,
280 	};
281 	struct sk_buff *skb;
282 
283 	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
284 				     &hdr.wlan_idx_hi);
285 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
286 	if (!skb)
287 		return ERR_PTR(-ENOMEM);
288 
289 	skb_put_data(skb, &hdr, sizeof(hdr));
290 
291 	return skb;
292 }
293 EXPORT_SYMBOL_GPL(__mt76_connac_mcu_alloc_sta_req);
294 
295 struct wtbl_req_hdr *
296 mt76_connac_mcu_alloc_wtbl_req(struct mt76_dev *dev, struct mt76_wcid *wcid,
297 			       int cmd, void *sta_wtbl, struct sk_buff **skb)
298 {
299 	struct tlv *sta_hdr = sta_wtbl;
300 	struct wtbl_req_hdr hdr = {
301 		.operation = cmd,
302 	};
303 	struct sk_buff *nskb = *skb;
304 
305 	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
306 				     &hdr.wlan_idx_hi);
307 	if (!nskb) {
308 		nskb = mt76_mcu_msg_alloc(dev, NULL,
309 					  MT76_CONNAC_WTBL_UPDATE_MAX_SIZE);
310 		if (!nskb)
311 			return ERR_PTR(-ENOMEM);
312 
313 		*skb = nskb;
314 	}
315 
316 	if (sta_hdr)
317 		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
318 
319 	return skb_put_data(nskb, &hdr, sizeof(hdr));
320 }
321 EXPORT_SYMBOL_GPL(mt76_connac_mcu_alloc_wtbl_req);
322 
323 void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,
324 				  struct ieee80211_vif *vif)
325 {
326 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
327 	u8 omac_idx = mvif->omac_idx;
328 	struct bss_info_omac *omac;
329 	struct tlv *tlv;
330 	u32 type = 0;
331 
332 	switch (vif->type) {
333 	case NL80211_IFTYPE_MONITOR:
334 	case NL80211_IFTYPE_MESH_POINT:
335 	case NL80211_IFTYPE_AP:
336 		if (vif->p2p)
337 			type = CONNECTION_P2P_GO;
338 		else
339 			type = CONNECTION_INFRA_AP;
340 		break;
341 	case NL80211_IFTYPE_STATION:
342 		if (vif->p2p)
343 			type = CONNECTION_P2P_GC;
344 		else
345 			type = CONNECTION_INFRA_STA;
346 		break;
347 	case NL80211_IFTYPE_ADHOC:
348 		type = CONNECTION_IBSS_ADHOC;
349 		break;
350 	default:
351 		WARN_ON(1);
352 		break;
353 	}
354 
355 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
356 
357 	omac = (struct bss_info_omac *)tlv;
358 	omac->conn_type = cpu_to_le32(type);
359 	omac->omac_idx = mvif->omac_idx;
360 	omac->band_idx = mvif->band_idx;
361 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
362 }
363 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
364 
365 void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
366 				   struct ieee80211_vif *vif,
367 				   struct ieee80211_sta *sta,
368 				   bool enable, bool newly)
369 {
370 	struct sta_rec_basic *basic;
371 	struct tlv *tlv;
372 	int conn_type;
373 
374 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
375 
376 	basic = (struct sta_rec_basic *)tlv;
377 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
378 
379 	if (enable) {
380 		if (newly)
381 			basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
382 		basic->conn_state = CONN_STATE_PORT_SECURE;
383 	} else {
384 		basic->conn_state = CONN_STATE_DISCONNECT;
385 	}
386 
387 	if (!sta) {
388 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
389 		eth_broadcast_addr(basic->peer_addr);
390 		return;
391 	}
392 
393 	switch (vif->type) {
394 	case NL80211_IFTYPE_MESH_POINT:
395 	case NL80211_IFTYPE_AP:
396 		if (vif->p2p)
397 			conn_type = CONNECTION_P2P_GC;
398 		else
399 			conn_type = CONNECTION_INFRA_STA;
400 		basic->conn_type = cpu_to_le32(conn_type);
401 		basic->aid = cpu_to_le16(sta->aid);
402 		break;
403 	case NL80211_IFTYPE_STATION:
404 		if (vif->p2p)
405 			conn_type = CONNECTION_P2P_GO;
406 		else
407 			conn_type = CONNECTION_INFRA_AP;
408 		basic->conn_type = cpu_to_le32(conn_type);
409 		basic->aid = cpu_to_le16(vif->cfg.aid);
410 		break;
411 	case NL80211_IFTYPE_ADHOC:
412 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
413 		basic->aid = cpu_to_le16(sta->aid);
414 		break;
415 	default:
416 		WARN_ON(1);
417 		break;
418 	}
419 
420 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
421 	basic->qos = sta->wme;
422 }
423 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
424 
425 void mt76_connac_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
426 			       struct ieee80211_sta *sta)
427 {
428 	struct sta_rec_uapsd *uapsd;
429 	struct tlv *tlv;
430 
431 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
432 		return;
433 
434 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
435 	uapsd = (struct sta_rec_uapsd *)tlv;
436 
437 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
438 		uapsd->dac_map |= BIT(3);
439 		uapsd->tac_map |= BIT(3);
440 	}
441 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
442 		uapsd->dac_map |= BIT(2);
443 		uapsd->tac_map |= BIT(2);
444 	}
445 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
446 		uapsd->dac_map |= BIT(1);
447 		uapsd->tac_map |= BIT(1);
448 	}
449 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
450 		uapsd->dac_map |= BIT(0);
451 		uapsd->tac_map |= BIT(0);
452 	}
453 	uapsd->max_sp = sta->max_sp;
454 }
455 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_uapsd);
456 
457 void mt76_connac_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb,
458 					struct ieee80211_vif *vif,
459 					struct mt76_wcid *wcid,
460 					void *sta_wtbl, void *wtbl_tlv)
461 {
462 	struct wtbl_hdr_trans *htr;
463 	struct tlv *tlv;
464 
465 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS,
466 					     sizeof(*htr),
467 					     wtbl_tlv, sta_wtbl);
468 	htr = (struct wtbl_hdr_trans *)tlv;
469 	htr->no_rx_trans = true;
470 
471 	if (vif->type == NL80211_IFTYPE_STATION)
472 		htr->to_ds = true;
473 	else
474 		htr->from_ds = true;
475 
476 	if (!wcid)
477 		return;
478 
479 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
480 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
481 		htr->to_ds = true;
482 		htr->from_ds = true;
483 	}
484 }
485 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_hdr_trans_tlv);
486 
487 int mt76_connac_mcu_sta_update_hdr_trans(struct mt76_dev *dev,
488 					 struct ieee80211_vif *vif,
489 					 struct mt76_wcid *wcid, int cmd)
490 {
491 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
492 	struct wtbl_req_hdr *wtbl_hdr;
493 	struct tlv *sta_wtbl;
494 	struct sk_buff *skb;
495 
496 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
497 	if (IS_ERR(skb))
498 		return PTR_ERR(skb);
499 
500 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
501 					   sizeof(struct tlv));
502 
503 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET,
504 						  sta_wtbl, &skb);
505 	if (IS_ERR(wtbl_hdr))
506 		return PTR_ERR(wtbl_hdr);
507 
508 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, sta_wtbl, wtbl_hdr);
509 
510 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
511 }
512 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_update_hdr_trans);
513 
514 int mt76_connac_mcu_wtbl_update_hdr_trans(struct mt76_dev *dev,
515 					  struct ieee80211_vif *vif,
516 					  struct ieee80211_sta *sta)
517 {
518 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
519 	struct wtbl_req_hdr *wtbl_hdr;
520 	struct sk_buff *skb = NULL;
521 
522 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET, NULL,
523 						  &skb);
524 	if (IS_ERR(wtbl_hdr))
525 		return PTR_ERR(wtbl_hdr);
526 
527 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, NULL, wtbl_hdr);
528 
529 	return mt76_mcu_skb_send_msg(dev, skb, MCU_EXT_CMD(WTBL_UPDATE), true);
530 }
531 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_update_hdr_trans);
532 
533 void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
534 				      struct sk_buff *skb,
535 				      struct ieee80211_vif *vif,
536 				      struct ieee80211_sta *sta,
537 				      void *sta_wtbl, void *wtbl_tlv)
538 {
539 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
540 	struct wtbl_generic *generic;
541 	struct wtbl_rx *rx;
542 	struct wtbl_spe *spe;
543 	struct tlv *tlv;
544 
545 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_GENERIC,
546 					     sizeof(*generic),
547 					     wtbl_tlv, sta_wtbl);
548 
549 	generic = (struct wtbl_generic *)tlv;
550 
551 	if (sta) {
552 		if (vif->type == NL80211_IFTYPE_STATION)
553 			generic->partial_aid = cpu_to_le16(vif->cfg.aid);
554 		else
555 			generic->partial_aid = cpu_to_le16(sta->aid);
556 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
557 		generic->muar_idx = mvif->omac_idx;
558 		generic->qos = sta->wme;
559 	} else {
560 		if (!is_connac_v1(dev) && vif->type == NL80211_IFTYPE_STATION)
561 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
562 			       ETH_ALEN);
563 		else
564 			eth_broadcast_addr(generic->peer_addr);
565 
566 		generic->muar_idx = 0xe;
567 	}
568 
569 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
570 					     wtbl_tlv, sta_wtbl);
571 
572 	rx = (struct wtbl_rx *)tlv;
573 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
574 	rx->rca2 = 1;
575 	rx->rv = 1;
576 
577 	if (!is_connac_v1(dev))
578 		return;
579 
580 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
581 					     wtbl_tlv, sta_wtbl);
582 	spe = (struct wtbl_spe *)tlv;
583 	spe->spe_idx = 24;
584 }
585 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_generic_tlv);
586 
587 static void
588 mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
589 			      struct ieee80211_vif *vif)
590 {
591 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
592 	struct sta_rec_amsdu *amsdu;
593 	struct tlv *tlv;
594 
595 	if (vif->type != NL80211_IFTYPE_AP &&
596 	    vif->type != NL80211_IFTYPE_STATION)
597 		return;
598 
599 	if (!sta->deflink.agg.max_amsdu_len)
600 		return;
601 
602 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
603 	amsdu = (struct sta_rec_amsdu *)tlv;
604 	amsdu->max_amsdu_num = 8;
605 	amsdu->amsdu_en = true;
606 	amsdu->max_mpdu_size = sta->deflink.agg.max_amsdu_len >=
607 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
608 
609 	wcid->amsdu = true;
610 }
611 
612 #define HE_PHY(p, c)	u8_get_bits(c, IEEE80211_HE_PHY_##p)
613 #define HE_MAC(m, c)	u8_get_bits(c, IEEE80211_HE_MAC_##m)
614 static void
615 mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
616 {
617 	struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
618 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
619 	struct sta_rec_he *he;
620 	struct tlv *tlv;
621 	u32 cap = 0;
622 
623 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
624 
625 	he = (struct sta_rec_he *)tlv;
626 
627 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
628 		cap |= STA_REC_HE_CAP_HTC;
629 
630 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
631 		cap |= STA_REC_HE_CAP_BSR;
632 
633 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
634 		cap |= STA_REC_HE_CAP_OM;
635 
636 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
637 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
638 
639 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
640 		cap |= STA_REC_HE_CAP_BQR;
641 
642 	if (elem->phy_cap_info[0] &
643 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
644 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
645 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
646 
647 	if (elem->phy_cap_info[1] &
648 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
649 		cap |= STA_REC_HE_CAP_LDPC;
650 
651 	if (elem->phy_cap_info[1] &
652 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
653 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
654 
655 	if (elem->phy_cap_info[2] &
656 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
657 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
658 
659 	if (elem->phy_cap_info[2] &
660 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
661 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
662 
663 	if (elem->phy_cap_info[2] &
664 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
665 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
666 
667 	if (elem->phy_cap_info[6] &
668 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
669 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
670 
671 	if (elem->phy_cap_info[7] &
672 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
673 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
674 
675 	if (elem->phy_cap_info[7] &
676 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
677 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
678 
679 	if (elem->phy_cap_info[7] &
680 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
681 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
682 
683 	if (elem->phy_cap_info[8] &
684 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
685 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
686 
687 	if (elem->phy_cap_info[8] &
688 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
689 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
690 
691 	if (elem->phy_cap_info[9] &
692 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
693 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
694 
695 	if (elem->phy_cap_info[9] &
696 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
697 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
698 
699 	if (elem->phy_cap_info[9] &
700 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
701 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
702 
703 	he->he_cap = cpu_to_le32(cap);
704 
705 	switch (sta->deflink.bandwidth) {
706 	case IEEE80211_STA_RX_BW_160:
707 		if (elem->phy_cap_info[0] &
708 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
709 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
710 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
711 
712 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
713 				he_cap->he_mcs_nss_supp.rx_mcs_160;
714 		fallthrough;
715 	default:
716 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
717 				he_cap->he_mcs_nss_supp.rx_mcs_80;
718 		break;
719 	}
720 
721 	he->t_frame_dur =
722 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
723 	he->max_ampdu_exp =
724 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
725 
726 	he->bw_set =
727 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
728 	he->device_class =
729 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
730 	he->punc_pream_rx =
731 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
732 
733 	he->dcm_tx_mode =
734 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
735 	he->dcm_tx_max_nss =
736 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
737 	he->dcm_rx_mode =
738 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
739 	he->dcm_rx_max_nss =
740 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
741 	he->dcm_rx_max_nss =
742 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
743 
744 	he->pkt_ext = 2;
745 }
746 
747 static u8
748 mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
749 			    enum nl80211_band band, struct ieee80211_sta *sta)
750 {
751 	struct ieee80211_sta_ht_cap *ht_cap;
752 	struct ieee80211_sta_vht_cap *vht_cap;
753 	const struct ieee80211_sta_he_cap *he_cap;
754 	u8 mode = 0;
755 
756 	if (sta) {
757 		ht_cap = &sta->deflink.ht_cap;
758 		vht_cap = &sta->deflink.vht_cap;
759 		he_cap = &sta->deflink.he_cap;
760 	} else {
761 		struct ieee80211_supported_band *sband;
762 
763 		sband = mphy->hw->wiphy->bands[band];
764 		ht_cap = &sband->ht_cap;
765 		vht_cap = &sband->vht_cap;
766 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
767 	}
768 
769 	if (band == NL80211_BAND_2GHZ) {
770 		mode |= PHY_TYPE_BIT_HR_DSSS | PHY_TYPE_BIT_ERP;
771 
772 		if (ht_cap->ht_supported)
773 			mode |= PHY_TYPE_BIT_HT;
774 
775 		if (he_cap && he_cap->has_he)
776 			mode |= PHY_TYPE_BIT_HE;
777 	} else if (band == NL80211_BAND_5GHZ || band == NL80211_BAND_6GHZ) {
778 		mode |= PHY_TYPE_BIT_OFDM;
779 
780 		if (ht_cap->ht_supported)
781 			mode |= PHY_TYPE_BIT_HT;
782 
783 		if (vht_cap->vht_supported)
784 			mode |= PHY_TYPE_BIT_VHT;
785 
786 		if (he_cap && he_cap->has_he)
787 			mode |= PHY_TYPE_BIT_HE;
788 	}
789 
790 	return mode;
791 }
792 
793 void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
794 			     struct ieee80211_sta *sta,
795 			     struct ieee80211_vif *vif,
796 			     u8 rcpi, u8 sta_state)
797 {
798 	struct cfg80211_chan_def *chandef = &mphy->chandef;
799 	enum nl80211_band band = chandef->chan->band;
800 	struct mt76_dev *dev = mphy->dev;
801 	struct sta_rec_ra_info *ra_info;
802 	struct sta_rec_state *state;
803 	struct sta_rec_phy *phy;
804 	struct tlv *tlv;
805 	u16 supp_rates;
806 
807 	/* starec ht */
808 	if (sta->deflink.ht_cap.ht_supported) {
809 		struct sta_rec_ht *ht;
810 
811 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
812 		ht = (struct sta_rec_ht *)tlv;
813 		ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
814 	}
815 
816 	/* starec vht */
817 	if (sta->deflink.vht_cap.vht_supported) {
818 		struct sta_rec_vht *vht;
819 		int len;
820 
821 		len = is_mt7921(dev) ? sizeof(*vht) : sizeof(*vht) - 4;
822 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, len);
823 		vht = (struct sta_rec_vht *)tlv;
824 		vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
825 		vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
826 		vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
827 	}
828 
829 	/* starec uapsd */
830 	mt76_connac_mcu_sta_uapsd(skb, vif, sta);
831 
832 	if (!is_mt7921(dev))
833 		return;
834 
835 	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he)
836 		mt76_connac_mcu_sta_amsdu_tlv(skb, sta, vif);
837 
838 	/* starec he */
839 	if (sta->deflink.he_cap.has_he) {
840 		mt76_connac_mcu_sta_he_tlv(skb, sta);
841 		if (band == NL80211_BAND_6GHZ &&
842 		    sta_state == MT76_STA_INFO_STATE_ASSOC) {
843 			struct sta_rec_he_6g_capa *he_6g_capa;
844 
845 			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
846 						      sizeof(*he_6g_capa));
847 			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
848 			he_6g_capa->capa = sta->deflink.he_6ghz_capa.capa;
849 		}
850 	}
851 
852 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
853 	phy = (struct sta_rec_phy *)tlv;
854 	phy->phy_type = mt76_connac_get_phy_mode_v2(mphy, vif, band, sta);
855 	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
856 	phy->rcpi = rcpi;
857 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
858 				sta->deflink.ht_cap.ampdu_factor) |
859 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY,
860 				sta->deflink.ht_cap.ampdu_density);
861 
862 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
863 	ra_info = (struct sta_rec_ra_info *)tlv;
864 
865 	supp_rates = sta->deflink.supp_rates[band];
866 	if (band == NL80211_BAND_2GHZ)
867 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
868 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
869 	else
870 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
871 
872 	ra_info->legacy = cpu_to_le16(supp_rates);
873 
874 	if (sta->deflink.ht_cap.ht_supported)
875 		memcpy(ra_info->rx_mcs_bitmask,
876 		       sta->deflink.ht_cap.mcs.rx_mask,
877 		       HT_MCS_MASK_NUM);
878 
879 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
880 	state = (struct sta_rec_state *)tlv;
881 	state->state = sta_state;
882 
883 	if (sta->deflink.vht_cap.vht_supported) {
884 		state->vht_opmode = sta->deflink.bandwidth;
885 		state->vht_opmode |= (sta->deflink.rx_nss - 1) <<
886 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
887 	}
888 }
889 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_tlv);
890 
891 void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
892 				   struct ieee80211_sta *sta,
893 				   void *sta_wtbl, void *wtbl_tlv)
894 {
895 	struct wtbl_smps *smps;
896 	struct tlv *tlv;
897 
898 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
899 					     wtbl_tlv, sta_wtbl);
900 	smps = (struct wtbl_smps *)tlv;
901 	smps->smps = (sta->deflink.smps_mode == IEEE80211_SMPS_DYNAMIC);
902 }
903 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
904 
905 void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
906 				 struct ieee80211_sta *sta, void *sta_wtbl,
907 				 void *wtbl_tlv, bool ht_ldpc, bool vht_ldpc)
908 {
909 	struct wtbl_ht *ht = NULL;
910 	struct tlv *tlv;
911 	u32 flags = 0;
912 
913 	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_6ghz_capa.capa) {
914 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
915 						     wtbl_tlv, sta_wtbl);
916 		ht = (struct wtbl_ht *)tlv;
917 		ht->ldpc = ht_ldpc &&
918 			   !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
919 
920 		if (sta->deflink.ht_cap.ht_supported) {
921 			ht->af = sta->deflink.ht_cap.ampdu_factor;
922 			ht->mm = sta->deflink.ht_cap.ampdu_density;
923 		} else {
924 			ht->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
925 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
926 			ht->mm = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
927 					       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
928 		}
929 
930 		ht->ht = true;
931 	}
932 
933 	if (sta->deflink.vht_cap.vht_supported || sta->deflink.he_6ghz_capa.capa) {
934 		struct wtbl_vht *vht;
935 		u8 af;
936 
937 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_VHT,
938 						     sizeof(*vht), wtbl_tlv,
939 						     sta_wtbl);
940 		vht = (struct wtbl_vht *)tlv;
941 		vht->ldpc = vht_ldpc &&
942 			    !!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
943 		vht->vht = true;
944 
945 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
946 			       sta->deflink.vht_cap.cap);
947 		if (ht)
948 			ht->af = max(ht->af, af);
949 	}
950 
951 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
952 
953 	if (is_connac_v1(dev) && sta->deflink.ht_cap.ht_supported) {
954 		/* sgi */
955 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
956 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
957 		struct wtbl_raw *raw;
958 
959 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
960 						     sizeof(*raw), wtbl_tlv,
961 						     sta_wtbl);
962 
963 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
964 			flags |= MT_WTBL_W5_SHORT_GI_20;
965 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
966 			flags |= MT_WTBL_W5_SHORT_GI_40;
967 
968 		if (sta->deflink.vht_cap.vht_supported) {
969 			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
970 				flags |= MT_WTBL_W5_SHORT_GI_80;
971 			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
972 				flags |= MT_WTBL_W5_SHORT_GI_160;
973 		}
974 		raw = (struct wtbl_raw *)tlv;
975 		raw->val = cpu_to_le32(flags);
976 		raw->msk = cpu_to_le32(~msk);
977 		raw->wtbl_idx = 1;
978 		raw->dw = 5;
979 	}
980 }
981 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_ht_tlv);
982 
983 int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
984 			    struct mt76_sta_cmd_info *info)
985 {
986 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
987 	struct mt76_dev *dev = phy->dev;
988 	struct wtbl_req_hdr *wtbl_hdr;
989 	struct tlv *sta_wtbl;
990 	struct sk_buff *skb;
991 
992 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid);
993 	if (IS_ERR(skb))
994 		return PTR_ERR(skb);
995 
996 	if (info->sta || !info->offload_fw)
997 		mt76_connac_mcu_sta_basic_tlv(skb, info->vif, info->sta,
998 					      info->enable, info->newly);
999 	if (info->sta && info->enable)
1000 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
1001 					info->vif, info->rcpi,
1002 					info->state);
1003 
1004 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1005 					   sizeof(struct tlv));
1006 
1007 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, info->wcid,
1008 						  WTBL_RESET_AND_SET,
1009 						  sta_wtbl, &skb);
1010 	if (IS_ERR(wtbl_hdr))
1011 		return PTR_ERR(wtbl_hdr);
1012 
1013 	if (info->enable) {
1014 		mt76_connac_mcu_wtbl_generic_tlv(dev, skb, info->vif,
1015 						 info->sta, sta_wtbl,
1016 						 wtbl_hdr);
1017 		mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, info->vif, info->wcid,
1018 						   sta_wtbl, wtbl_hdr);
1019 		if (info->sta)
1020 			mt76_connac_mcu_wtbl_ht_tlv(dev, skb, info->sta,
1021 						    sta_wtbl, wtbl_hdr,
1022 						    true, true);
1023 	}
1024 
1025 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1026 }
1027 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_cmd);
1028 
1029 void mt76_connac_mcu_wtbl_ba_tlv(struct mt76_dev *dev, struct sk_buff *skb,
1030 				 struct ieee80211_ampdu_params *params,
1031 				 bool enable, bool tx, void *sta_wtbl,
1032 				 void *wtbl_tlv)
1033 {
1034 	struct wtbl_ba *ba;
1035 	struct tlv *tlv;
1036 
1037 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1038 					     wtbl_tlv, sta_wtbl);
1039 
1040 	ba = (struct wtbl_ba *)tlv;
1041 	ba->tid = params->tid;
1042 
1043 	if (tx) {
1044 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1045 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1046 		ba->ba_winsize = enable ? cpu_to_le16(params->buf_size) : 0;
1047 		ba->ba_en = enable;
1048 	} else {
1049 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1050 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1051 		ba->rst_ba_tid = params->tid;
1052 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1053 		ba->rst_ba_sb = 1;
1054 	}
1055 
1056 	if (!is_connac_v1(dev)) {
1057 		ba->ba_winsize = enable ? cpu_to_le16(params->buf_size) : 0;
1058 		return;
1059 	}
1060 
1061 	if (enable && tx) {
1062 		static const u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1063 		int i;
1064 
1065 		for (i = 7; i > 0; i--) {
1066 			if (params->buf_size >= ba_range[i])
1067 				break;
1068 		}
1069 		ba->ba_winsize_idx = i;
1070 	}
1071 }
1072 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_ba_tlv);
1073 
1074 int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy,
1075 				struct ieee80211_vif *vif,
1076 				struct mt76_wcid *wcid,
1077 				bool enable)
1078 {
1079 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1080 	struct mt76_dev *dev = phy->dev;
1081 	struct {
1082 		struct {
1083 			u8 omac_idx;
1084 			u8 band_idx;
1085 			__le16 pad;
1086 		} __packed hdr;
1087 		struct req_tlv {
1088 			__le16 tag;
1089 			__le16 len;
1090 			u8 active;
1091 			u8 pad;
1092 			u8 omac_addr[ETH_ALEN];
1093 		} __packed tlv;
1094 	} dev_req = {
1095 		.hdr = {
1096 			.omac_idx = mvif->omac_idx,
1097 			.band_idx = mvif->band_idx,
1098 		},
1099 		.tlv = {
1100 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1101 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1102 			.active = enable,
1103 		},
1104 	};
1105 	struct {
1106 		struct {
1107 			u8 bss_idx;
1108 			u8 pad[3];
1109 		} __packed hdr;
1110 		struct mt76_connac_bss_basic_tlv basic;
1111 	} basic_req = {
1112 		.hdr = {
1113 			.bss_idx = mvif->idx,
1114 		},
1115 		.basic = {
1116 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1117 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
1118 			.omac_idx = mvif->omac_idx,
1119 			.band_idx = mvif->band_idx,
1120 			.wmm_idx = mvif->wmm_idx,
1121 			.active = enable,
1122 			.bmc_tx_wlan_idx = cpu_to_le16(wcid->idx),
1123 			.sta_idx = cpu_to_le16(wcid->idx),
1124 			.conn_state = 1,
1125 		},
1126 	};
1127 	int err, idx, cmd, len;
1128 	void *data;
1129 
1130 	switch (vif->type) {
1131 	case NL80211_IFTYPE_MESH_POINT:
1132 	case NL80211_IFTYPE_MONITOR:
1133 	case NL80211_IFTYPE_AP:
1134 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1135 		break;
1136 	case NL80211_IFTYPE_STATION:
1137 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1138 		break;
1139 	case NL80211_IFTYPE_ADHOC:
1140 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1141 		break;
1142 	default:
1143 		WARN_ON(1);
1144 		break;
1145 	}
1146 
1147 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1148 	basic_req.basic.hw_bss_idx = idx;
1149 
1150 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1151 
1152 	cmd = enable ? MCU_UNI_CMD(DEV_INFO_UPDATE) : MCU_UNI_CMD(BSS_INFO_UPDATE);
1153 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1154 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1155 
1156 	err = mt76_mcu_send_msg(dev, cmd, data, len, true);
1157 	if (err < 0)
1158 		return err;
1159 
1160 	cmd = enable ? MCU_UNI_CMD(BSS_INFO_UPDATE) : MCU_UNI_CMD(DEV_INFO_UPDATE);
1161 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1162 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1163 
1164 	return mt76_mcu_send_msg(dev, cmd, data, len, true);
1165 }
1166 EXPORT_SYMBOL_GPL(mt76_connac_mcu_uni_add_dev);
1167 
1168 void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,
1169 				struct ieee80211_ampdu_params *params,
1170 				bool enable, bool tx)
1171 {
1172 	struct sta_rec_ba *ba;
1173 	struct tlv *tlv;
1174 
1175 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1176 
1177 	ba = (struct sta_rec_ba *)tlv;
1178 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1179 	ba->winsize = cpu_to_le16(params->buf_size);
1180 	ba->ssn = cpu_to_le16(params->ssn);
1181 	ba->ba_en = enable << params->tid;
1182 	ba->amsdu = params->amsdu;
1183 	ba->tid = params->tid;
1184 }
1185 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv);
1186 
1187 int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
1188 			   struct ieee80211_ampdu_params *params,
1189 			   int cmd, bool enable, bool tx)
1190 {
1191 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
1192 	struct wtbl_req_hdr *wtbl_hdr;
1193 	struct tlv *sta_wtbl;
1194 	struct sk_buff *skb;
1195 	int ret;
1196 
1197 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
1198 	if (IS_ERR(skb))
1199 		return PTR_ERR(skb);
1200 
1201 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1202 					   sizeof(struct tlv));
1203 
1204 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET,
1205 						  sta_wtbl, &skb);
1206 	if (IS_ERR(wtbl_hdr))
1207 		return PTR_ERR(wtbl_hdr);
1208 
1209 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
1210 				    wtbl_hdr);
1211 
1212 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
1213 	if (ret)
1214 		return ret;
1215 
1216 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
1217 	if (IS_ERR(skb))
1218 		return PTR_ERR(skb);
1219 
1220 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1221 
1222 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
1223 }
1224 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
1225 
1226 u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
1227 			    enum nl80211_band band, struct ieee80211_sta *sta)
1228 {
1229 	struct mt76_dev *dev = phy->dev;
1230 	const struct ieee80211_sta_he_cap *he_cap;
1231 	struct ieee80211_sta_vht_cap *vht_cap;
1232 	struct ieee80211_sta_ht_cap *ht_cap;
1233 	u8 mode = 0;
1234 
1235 	if (is_connac_v1(dev))
1236 		return 0x38;
1237 
1238 	if (sta) {
1239 		ht_cap = &sta->deflink.ht_cap;
1240 		vht_cap = &sta->deflink.vht_cap;
1241 		he_cap = &sta->deflink.he_cap;
1242 	} else {
1243 		struct ieee80211_supported_band *sband;
1244 
1245 		sband = phy->hw->wiphy->bands[band];
1246 		ht_cap = &sband->ht_cap;
1247 		vht_cap = &sband->vht_cap;
1248 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
1249 	}
1250 
1251 	if (band == NL80211_BAND_2GHZ) {
1252 		mode |= PHY_MODE_B | PHY_MODE_G;
1253 
1254 		if (ht_cap->ht_supported)
1255 			mode |= PHY_MODE_GN;
1256 
1257 		if (he_cap && he_cap->has_he)
1258 			mode |= PHY_MODE_AX_24G;
1259 	} else if (band == NL80211_BAND_5GHZ) {
1260 		mode |= PHY_MODE_A;
1261 
1262 		if (ht_cap->ht_supported)
1263 			mode |= PHY_MODE_AN;
1264 
1265 		if (vht_cap->vht_supported)
1266 			mode |= PHY_MODE_AC;
1267 
1268 		if (he_cap && he_cap->has_he)
1269 			mode |= PHY_MODE_AX_5G;
1270 	} else if (band == NL80211_BAND_6GHZ) {
1271 		mode |= PHY_MODE_A | PHY_MODE_AN |
1272 			PHY_MODE_AC | PHY_MODE_AX_5G;
1273 	}
1274 
1275 	return mode;
1276 }
1277 EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
1278 
1279 const struct ieee80211_sta_he_cap *
1280 mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
1281 {
1282 	enum nl80211_band band = phy->chandef.chan->band;
1283 	struct ieee80211_supported_band *sband;
1284 
1285 	sband = phy->hw->wiphy->bands[band];
1286 
1287 	return ieee80211_get_he_iftype_cap(sband, vif->type);
1288 }
1289 EXPORT_SYMBOL_GPL(mt76_connac_get_he_phy_cap);
1290 
1291 #define DEFAULT_HE_PE_DURATION		4
1292 #define DEFAULT_HE_DURATION_RTS_THRES	1023
1293 static void
1294 mt76_connac_mcu_uni_bss_he_tlv(struct mt76_phy *phy, struct ieee80211_vif *vif,
1295 			       struct tlv *tlv)
1296 {
1297 	const struct ieee80211_sta_he_cap *cap;
1298 	struct bss_info_uni_he *he;
1299 
1300 	cap = mt76_connac_get_he_phy_cap(phy, vif);
1301 
1302 	he = (struct bss_info_uni_he *)tlv;
1303 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
1304 	if (!he->he_pe_duration)
1305 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
1306 
1307 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
1308 	if (!he->he_rts_thres)
1309 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
1310 
1311 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
1312 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
1313 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
1314 }
1315 
1316 int mt76_connac_mcu_uni_add_bss(struct mt76_phy *phy,
1317 				struct ieee80211_vif *vif,
1318 				struct mt76_wcid *wcid,
1319 				bool enable)
1320 {
1321 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1322 	struct cfg80211_chan_def *chandef = &phy->chandef;
1323 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1324 	enum nl80211_band band = chandef->chan->band;
1325 	struct mt76_dev *mdev = phy->dev;
1326 	struct {
1327 		struct {
1328 			u8 bss_idx;
1329 			u8 pad[3];
1330 		} __packed hdr;
1331 		struct mt76_connac_bss_basic_tlv basic;
1332 		struct mt76_connac_bss_qos_tlv qos;
1333 	} basic_req = {
1334 		.hdr = {
1335 			.bss_idx = mvif->idx,
1336 		},
1337 		.basic = {
1338 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1339 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
1340 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1341 			.dtim_period = vif->bss_conf.dtim_period,
1342 			.omac_idx = mvif->omac_idx,
1343 			.band_idx = mvif->band_idx,
1344 			.wmm_idx = mvif->wmm_idx,
1345 			.active = true, /* keep bss deactivated */
1346 			.phymode = mt76_connac_get_phy_mode(phy, vif, band, NULL),
1347 		},
1348 		.qos = {
1349 			.tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1350 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_qos_tlv)),
1351 			.qos = vif->bss_conf.qos,
1352 		},
1353 	};
1354 	struct {
1355 		struct {
1356 			u8 bss_idx;
1357 			u8 pad[3];
1358 		} __packed hdr;
1359 		struct rlm_tlv {
1360 			__le16 tag;
1361 			__le16 len;
1362 			u8 control_channel;
1363 			u8 center_chan;
1364 			u8 center_chan2;
1365 			u8 bw;
1366 			u8 tx_streams;
1367 			u8 rx_streams;
1368 			u8 short_st;
1369 			u8 ht_op_info;
1370 			u8 sco;
1371 			u8 band;
1372 			u8 pad[2];
1373 		} __packed rlm;
1374 	} __packed rlm_req = {
1375 		.hdr = {
1376 			.bss_idx = mvif->idx,
1377 		},
1378 		.rlm = {
1379 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1380 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1381 			.control_channel = chandef->chan->hw_value,
1382 			.center_chan = ieee80211_frequency_to_channel(freq1),
1383 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1384 			.tx_streams = hweight8(phy->antenna_mask),
1385 			.ht_op_info = 4, /* set HT 40M allowed */
1386 			.rx_streams = phy->chainmask,
1387 			.short_st = true,
1388 			.band = band,
1389 		},
1390 	};
1391 	int err, conn_type;
1392 	u8 idx, basic_phy;
1393 
1394 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1395 	basic_req.basic.hw_bss_idx = idx;
1396 	if (band == NL80211_BAND_6GHZ)
1397 		basic_req.basic.phymode_ext = PHY_MODE_AX_6G;
1398 
1399 	basic_phy = mt76_connac_get_phy_mode_v2(phy, vif, band, NULL);
1400 	basic_req.basic.nonht_basic_phy = cpu_to_le16(basic_phy);
1401 
1402 	switch (vif->type) {
1403 	case NL80211_IFTYPE_MESH_POINT:
1404 	case NL80211_IFTYPE_AP:
1405 		if (vif->p2p)
1406 			conn_type = CONNECTION_P2P_GO;
1407 		else
1408 			conn_type = CONNECTION_INFRA_AP;
1409 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1410 		/* Fully active/deactivate BSS network in AP mode only */
1411 		basic_req.basic.active = enable;
1412 		break;
1413 	case NL80211_IFTYPE_STATION:
1414 		if (vif->p2p)
1415 			conn_type = CONNECTION_P2P_GC;
1416 		else
1417 			conn_type = CONNECTION_INFRA_STA;
1418 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1419 		break;
1420 	case NL80211_IFTYPE_ADHOC:
1421 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1422 		break;
1423 	default:
1424 		WARN_ON(1);
1425 		break;
1426 	}
1427 
1428 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1429 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(wcid->idx);
1430 	basic_req.basic.sta_idx = cpu_to_le16(wcid->idx);
1431 	basic_req.basic.conn_state = !enable;
1432 
1433 	err = mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE), &basic_req,
1434 				sizeof(basic_req), true);
1435 	if (err < 0)
1436 		return err;
1437 
1438 	if (vif->bss_conf.he_support) {
1439 		struct {
1440 			struct {
1441 				u8 bss_idx;
1442 				u8 pad[3];
1443 			} __packed hdr;
1444 			struct bss_info_uni_he he;
1445 			struct bss_info_uni_bss_color bss_color;
1446 		} he_req = {
1447 			.hdr = {
1448 				.bss_idx = mvif->idx,
1449 			},
1450 			.he = {
1451 				.tag = cpu_to_le16(UNI_BSS_INFO_HE_BASIC),
1452 				.len = cpu_to_le16(sizeof(struct bss_info_uni_he)),
1453 			},
1454 			.bss_color = {
1455 				.tag = cpu_to_le16(UNI_BSS_INFO_BSS_COLOR),
1456 				.len = cpu_to_le16(sizeof(struct bss_info_uni_bss_color)),
1457 				.enable = 0,
1458 				.bss_color = 0,
1459 			},
1460 		};
1461 
1462 		if (enable) {
1463 			he_req.bss_color.enable =
1464 				vif->bss_conf.he_bss_color.enabled;
1465 			he_req.bss_color.bss_color =
1466 				vif->bss_conf.he_bss_color.color;
1467 		}
1468 
1469 		mt76_connac_mcu_uni_bss_he_tlv(phy, vif,
1470 					       (struct tlv *)&he_req.he);
1471 		err = mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE),
1472 					&he_req, sizeof(he_req), true);
1473 		if (err < 0)
1474 			return err;
1475 	}
1476 
1477 	switch (chandef->width) {
1478 	case NL80211_CHAN_WIDTH_40:
1479 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1480 		break;
1481 	case NL80211_CHAN_WIDTH_80:
1482 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1483 		break;
1484 	case NL80211_CHAN_WIDTH_80P80:
1485 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1486 		break;
1487 	case NL80211_CHAN_WIDTH_160:
1488 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1489 		break;
1490 	case NL80211_CHAN_WIDTH_5:
1491 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1492 		break;
1493 	case NL80211_CHAN_WIDTH_10:
1494 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1495 		break;
1496 	case NL80211_CHAN_WIDTH_20_NOHT:
1497 	case NL80211_CHAN_WIDTH_20:
1498 	default:
1499 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1500 		rlm_req.rlm.ht_op_info = 0;
1501 		break;
1502 	}
1503 
1504 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1505 		rlm_req.rlm.sco = 1; /* SCA */
1506 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1507 		rlm_req.rlm.sco = 3; /* SCB */
1508 
1509 	return mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE), &rlm_req,
1510 				 sizeof(rlm_req), true);
1511 }
1512 EXPORT_SYMBOL_GPL(mt76_connac_mcu_uni_add_bss);
1513 
1514 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
1515 int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
1516 			    struct ieee80211_scan_request *scan_req)
1517 {
1518 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1519 	struct cfg80211_scan_request *sreq = &scan_req->req;
1520 	int n_ssids = 0, err, i, duration;
1521 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
1522 	struct ieee80211_channel **scan_list = sreq->channels;
1523 	struct mt76_dev *mdev = phy->dev;
1524 	struct mt76_connac_mcu_scan_channel *chan;
1525 	struct mt76_connac_hw_scan_req *req;
1526 	struct sk_buff *skb;
1527 
1528 	skb = mt76_mcu_msg_alloc(mdev, NULL, sizeof(*req));
1529 	if (!skb)
1530 		return -ENOMEM;
1531 
1532 	set_bit(MT76_HW_SCANNING, &phy->state);
1533 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
1534 
1535 	req = (struct mt76_connac_hw_scan_req *)skb_put(skb, sizeof(*req));
1536 
1537 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
1538 	req->bss_idx = mvif->idx;
1539 	req->scan_type = sreq->n_ssids ? 1 : 0;
1540 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
1541 	req->version = 1;
1542 
1543 	for (i = 0; i < sreq->n_ssids; i++) {
1544 		if (!sreq->ssids[i].ssid_len)
1545 			continue;
1546 
1547 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
1548 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
1549 		       sreq->ssids[i].ssid_len);
1550 		n_ssids++;
1551 	}
1552 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
1553 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
1554 	req->ssids_num = n_ssids;
1555 
1556 	duration = is_mt7921(phy->dev) ? 0 : MT76_CONNAC_SCAN_CHANNEL_TIME;
1557 	/* increase channel time for passive scan */
1558 	if (!sreq->n_ssids)
1559 		duration *= 2;
1560 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
1561 	req->channel_min_dwell_time = cpu_to_le16(duration);
1562 	req->channel_dwell_time = cpu_to_le16(duration);
1563 
1564 	req->channels_num = min_t(u8, sreq->n_channels, 32);
1565 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
1566 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
1567 		if (i >= 32)
1568 			chan = &req->ext_channels[i - 32];
1569 		else
1570 			chan = &req->channels[i];
1571 
1572 		switch (scan_list[i]->band) {
1573 		case NL80211_BAND_2GHZ:
1574 			chan->band = 1;
1575 			break;
1576 		case NL80211_BAND_6GHZ:
1577 			chan->band = 3;
1578 			break;
1579 		default:
1580 			chan->band = 2;
1581 			break;
1582 		}
1583 		chan->channel_num = scan_list[i]->hw_value;
1584 	}
1585 	req->channel_type = sreq->n_channels ? 4 : 0;
1586 
1587 	if (sreq->ie_len > 0) {
1588 		memcpy(req->ies, sreq->ie, sreq->ie_len);
1589 		req->ies_len = cpu_to_le16(sreq->ie_len);
1590 	}
1591 
1592 	if (is_mt7921(phy->dev))
1593 		req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
1594 
1595 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
1596 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
1597 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
1598 				     sreq->mac_addr_mask);
1599 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
1600 	}
1601 
1602 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(START_HW_SCAN),
1603 				    false);
1604 	if (err < 0)
1605 		clear_bit(MT76_HW_SCANNING, &phy->state);
1606 
1607 	return err;
1608 }
1609 EXPORT_SYMBOL_GPL(mt76_connac_mcu_hw_scan);
1610 
1611 int mt76_connac_mcu_cancel_hw_scan(struct mt76_phy *phy,
1612 				   struct ieee80211_vif *vif)
1613 {
1614 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1615 	struct {
1616 		u8 seq_num;
1617 		u8 is_ext_channel;
1618 		u8 rsv[2];
1619 	} __packed req = {
1620 		.seq_num = mvif->scan_seq_num,
1621 	};
1622 
1623 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
1624 		struct cfg80211_scan_info info = {
1625 			.aborted = true,
1626 		};
1627 
1628 		ieee80211_scan_completed(phy->hw, &info);
1629 	}
1630 
1631 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(CANCEL_HW_SCAN),
1632 				 &req, sizeof(req), false);
1633 }
1634 EXPORT_SYMBOL_GPL(mt76_connac_mcu_cancel_hw_scan);
1635 
1636 int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
1637 				   struct ieee80211_vif *vif,
1638 				   struct cfg80211_sched_scan_request *sreq)
1639 {
1640 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1641 	struct ieee80211_channel **scan_list = sreq->channels;
1642 	struct mt76_connac_mcu_scan_channel *chan;
1643 	struct mt76_connac_sched_scan_req *req;
1644 	struct mt76_dev *mdev = phy->dev;
1645 	struct cfg80211_match_set *match;
1646 	struct cfg80211_ssid *ssid;
1647 	struct sk_buff *skb;
1648 	int i;
1649 
1650 	skb = mt76_mcu_msg_alloc(mdev, NULL, sizeof(*req) + sreq->ie_len);
1651 	if (!skb)
1652 		return -ENOMEM;
1653 
1654 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
1655 
1656 	req = (struct mt76_connac_sched_scan_req *)skb_put(skb, sizeof(*req));
1657 	req->version = 1;
1658 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
1659 
1660 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
1661 		u8 *addr = is_mt7663(phy->dev) ? req->mt7663.random_mac
1662 					       : req->mt7921.random_mac;
1663 
1664 		req->scan_func = 1;
1665 		get_random_mask_addr(addr, sreq->mac_addr,
1666 				     sreq->mac_addr_mask);
1667 	}
1668 	if (is_mt7921(phy->dev)) {
1669 		req->mt7921.bss_idx = mvif->idx;
1670 		req->mt7921.delay = cpu_to_le32(sreq->delay);
1671 	}
1672 
1673 	req->ssids_num = sreq->n_ssids;
1674 	for (i = 0; i < req->ssids_num; i++) {
1675 		ssid = &sreq->ssids[i];
1676 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
1677 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
1678 	}
1679 
1680 	req->match_num = sreq->n_match_sets;
1681 	for (i = 0; i < req->match_num; i++) {
1682 		match = &sreq->match_sets[i];
1683 		memcpy(req->match[i].ssid, match->ssid.ssid,
1684 		       match->ssid.ssid_len);
1685 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
1686 		req->match[i].ssid_len = match->ssid.ssid_len;
1687 	}
1688 
1689 	req->channel_type = sreq->n_channels ? 4 : 0;
1690 	req->channels_num = min_t(u8, sreq->n_channels, 64);
1691 	for (i = 0; i < req->channels_num; i++) {
1692 		chan = &req->channels[i];
1693 
1694 		switch (scan_list[i]->band) {
1695 		case NL80211_BAND_2GHZ:
1696 			chan->band = 1;
1697 			break;
1698 		case NL80211_BAND_6GHZ:
1699 			chan->band = 3;
1700 			break;
1701 		default:
1702 			chan->band = 2;
1703 			break;
1704 		}
1705 		chan->channel_num = scan_list[i]->hw_value;
1706 	}
1707 
1708 	req->intervals_num = sreq->n_scan_plans;
1709 	for (i = 0; i < req->intervals_num; i++)
1710 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
1711 
1712 	if (sreq->ie_len > 0) {
1713 		req->ie_len = cpu_to_le16(sreq->ie_len);
1714 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
1715 	}
1716 
1717 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(SCHED_SCAN_REQ),
1718 				     false);
1719 }
1720 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_req);
1721 
1722 int mt76_connac_mcu_sched_scan_enable(struct mt76_phy *phy,
1723 				      struct ieee80211_vif *vif,
1724 				      bool enable)
1725 {
1726 	struct {
1727 		u8 active; /* 0: enabled 1: disabled */
1728 		u8 rsv[3];
1729 	} __packed req = {
1730 		.active = !enable,
1731 	};
1732 
1733 	if (enable)
1734 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
1735 	else
1736 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
1737 
1738 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SCHED_SCAN_ENABLE),
1739 				 &req, sizeof(req), false);
1740 }
1741 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_enable);
1742 
1743 int mt76_connac_mcu_chip_config(struct mt76_dev *dev)
1744 {
1745 	struct mt76_connac_config req = {
1746 		.resp_type = 0,
1747 	};
1748 
1749 	memcpy(req.data, "assert", 7);
1750 
1751 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
1752 				 &req, sizeof(req), false);
1753 }
1754 EXPORT_SYMBOL_GPL(mt76_connac_mcu_chip_config);
1755 
1756 int mt76_connac_mcu_set_deep_sleep(struct mt76_dev *dev, bool enable)
1757 {
1758 	struct mt76_connac_config req = {
1759 		.resp_type = 0,
1760 	};
1761 
1762 	snprintf(req.data, sizeof(req.data), "KeepFullPwr %d", !enable);
1763 
1764 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
1765 				 &req, sizeof(req), false);
1766 }
1767 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_deep_sleep);
1768 
1769 int mt76_connac_sta_state_dp(struct mt76_dev *dev,
1770 			     enum ieee80211_sta_state old_state,
1771 			     enum ieee80211_sta_state new_state)
1772 {
1773 	if ((old_state == IEEE80211_STA_ASSOC &&
1774 	     new_state == IEEE80211_STA_AUTHORIZED) ||
1775 	    (old_state == IEEE80211_STA_NONE &&
1776 	     new_state == IEEE80211_STA_NOTEXIST))
1777 		mt76_connac_mcu_set_deep_sleep(dev, true);
1778 
1779 	if ((old_state == IEEE80211_STA_NOTEXIST &&
1780 	     new_state == IEEE80211_STA_NONE) ||
1781 	    (old_state == IEEE80211_STA_AUTHORIZED &&
1782 	     new_state == IEEE80211_STA_ASSOC))
1783 		mt76_connac_mcu_set_deep_sleep(dev, false);
1784 
1785 	return 0;
1786 }
1787 EXPORT_SYMBOL_GPL(mt76_connac_sta_state_dp);
1788 
1789 void mt76_connac_mcu_coredump_event(struct mt76_dev *dev, struct sk_buff *skb,
1790 				    struct mt76_connac_coredump *coredump)
1791 {
1792 	spin_lock_bh(&dev->lock);
1793 	__skb_queue_tail(&coredump->msg_list, skb);
1794 	spin_unlock_bh(&dev->lock);
1795 
1796 	coredump->last_activity = jiffies;
1797 
1798 	queue_delayed_work(dev->wq, &coredump->work,
1799 			   MT76_CONNAC_COREDUMP_TIMEOUT);
1800 }
1801 EXPORT_SYMBOL_GPL(mt76_connac_mcu_coredump_event);
1802 
1803 static void mt76_connac_mcu_parse_tx_resource(struct mt76_dev *dev,
1804 					      struct sk_buff *skb)
1805 {
1806 	struct mt76_sdio *sdio = &dev->sdio;
1807 	struct mt76_connac_tx_resource {
1808 		__le32 version;
1809 		__le32 pse_data_quota;
1810 		__le32 pse_mcu_quota;
1811 		__le32 ple_data_quota;
1812 		__le32 ple_mcu_quota;
1813 		__le16 pse_page_size;
1814 		__le16 ple_page_size;
1815 		u8 pp_padding;
1816 		u8 pad[3];
1817 	} __packed * tx_res;
1818 
1819 	tx_res = (struct mt76_connac_tx_resource *)skb->data;
1820 	sdio->sched.pse_data_quota = le32_to_cpu(tx_res->pse_data_quota);
1821 	sdio->sched.pse_mcu_quota = le32_to_cpu(tx_res->pse_mcu_quota);
1822 	sdio->sched.ple_data_quota = le32_to_cpu(tx_res->ple_data_quota);
1823 	sdio->sched.pse_page_size = le16_to_cpu(tx_res->pse_page_size);
1824 	sdio->sched.deficit = tx_res->pp_padding;
1825 }
1826 
1827 static void mt76_connac_mcu_parse_phy_cap(struct mt76_dev *dev,
1828 					  struct sk_buff *skb)
1829 {
1830 	struct mt76_connac_phy_cap {
1831 		u8 ht;
1832 		u8 vht;
1833 		u8 _5g;
1834 		u8 max_bw;
1835 		u8 nss;
1836 		u8 dbdc;
1837 		u8 tx_ldpc;
1838 		u8 rx_ldpc;
1839 		u8 tx_stbc;
1840 		u8 rx_stbc;
1841 		u8 hw_path;
1842 		u8 he;
1843 	} __packed * cap;
1844 
1845 	enum {
1846 		WF0_24G,
1847 		WF0_5G
1848 	};
1849 
1850 	cap = (struct mt76_connac_phy_cap *)skb->data;
1851 
1852 	dev->phy.antenna_mask = BIT(cap->nss) - 1;
1853 	dev->phy.chainmask = dev->phy.antenna_mask;
1854 	dev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
1855 	dev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
1856 }
1857 
1858 int mt76_connac_mcu_get_nic_capability(struct mt76_phy *phy)
1859 {
1860 	struct mt76_connac_cap_hdr {
1861 		__le16 n_element;
1862 		u8 rsv[2];
1863 	} __packed * hdr;
1864 	struct sk_buff *skb;
1865 	int ret, i;
1866 
1867 	ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CE_CMD(GET_NIC_CAPAB),
1868 					NULL, 0, true, &skb);
1869 	if (ret)
1870 		return ret;
1871 
1872 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
1873 	if (skb->len < sizeof(*hdr)) {
1874 		ret = -EINVAL;
1875 		goto out;
1876 	}
1877 
1878 	skb_pull(skb, sizeof(*hdr));
1879 
1880 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
1881 		struct tlv_hdr {
1882 			__le32 type;
1883 			__le32 len;
1884 		} __packed * tlv = (struct tlv_hdr *)skb->data;
1885 		int len;
1886 
1887 		if (skb->len < sizeof(*tlv))
1888 			break;
1889 
1890 		skb_pull(skb, sizeof(*tlv));
1891 
1892 		len = le32_to_cpu(tlv->len);
1893 		if (skb->len < len)
1894 			break;
1895 
1896 		switch (le32_to_cpu(tlv->type)) {
1897 		case MT_NIC_CAP_6G:
1898 			phy->cap.has_6ghz = skb->data[0];
1899 			break;
1900 		case MT_NIC_CAP_MAC_ADDR:
1901 			memcpy(phy->macaddr, (void *)skb->data, ETH_ALEN);
1902 			break;
1903 		case MT_NIC_CAP_PHY:
1904 			mt76_connac_mcu_parse_phy_cap(phy->dev, skb);
1905 			break;
1906 		case MT_NIC_CAP_TX_RESOURCE:
1907 			if (mt76_is_sdio(phy->dev))
1908 				mt76_connac_mcu_parse_tx_resource(phy->dev,
1909 								  skb);
1910 			break;
1911 		default:
1912 			break;
1913 		}
1914 		skb_pull(skb, len);
1915 	}
1916 out:
1917 	dev_kfree_skb(skb);
1918 
1919 	return ret;
1920 }
1921 EXPORT_SYMBOL_GPL(mt76_connac_mcu_get_nic_capability);
1922 
1923 static void
1924 mt76_connac_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
1925 			  struct mt76_power_limits *limits,
1926 			  enum nl80211_band band)
1927 {
1928 	int max_power = is_mt7921(dev) ? 127 : 63;
1929 	int i, offset = sizeof(limits->cck);
1930 
1931 	memset(sku, max_power, MT_SKU_POWER_LIMIT);
1932 
1933 	if (band == NL80211_BAND_2GHZ) {
1934 		/* cck */
1935 		memcpy(sku, limits->cck, sizeof(limits->cck));
1936 	}
1937 
1938 	/* ofdm */
1939 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
1940 	offset += sizeof(limits->ofdm);
1941 
1942 	/* ht */
1943 	for (i = 0; i < 2; i++) {
1944 		memcpy(&sku[offset], limits->mcs[i], 8);
1945 		offset += 8;
1946 	}
1947 	sku[offset++] = limits->mcs[0][0];
1948 
1949 	/* vht */
1950 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
1951 		memcpy(&sku[offset], limits->mcs[i],
1952 		       ARRAY_SIZE(limits->mcs[i]));
1953 		offset += 12;
1954 	}
1955 
1956 	if (!is_mt7921(dev))
1957 		return;
1958 
1959 	/* he */
1960 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
1961 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
1962 		offset += ARRAY_SIZE(limits->ru[i]);
1963 	}
1964 }
1965 
1966 static s8 mt76_connac_get_ch_power(struct mt76_phy *phy,
1967 				   struct ieee80211_channel *chan,
1968 				   s8 target_power)
1969 {
1970 	struct mt76_dev *dev = phy->dev;
1971 	struct ieee80211_supported_band *sband;
1972 	int i;
1973 
1974 	switch (chan->band) {
1975 	case NL80211_BAND_2GHZ:
1976 		sband = &phy->sband_2g.sband;
1977 		break;
1978 	case NL80211_BAND_5GHZ:
1979 		sband = &phy->sband_5g.sband;
1980 		break;
1981 	case NL80211_BAND_6GHZ:
1982 		sband = &phy->sband_6g.sband;
1983 		break;
1984 	default:
1985 		return target_power;
1986 	}
1987 
1988 	for (i = 0; i < sband->n_channels; i++) {
1989 		struct ieee80211_channel *ch = &sband->channels[i];
1990 
1991 		if (ch->hw_value == chan->hw_value) {
1992 			if (!(ch->flags & IEEE80211_CHAN_DISABLED)) {
1993 				int power = 2 * ch->max_reg_power;
1994 
1995 				if (is_mt7663(dev) && (power > 63 || power < -64))
1996 					power = 63;
1997 				target_power = min_t(s8, power, target_power);
1998 			}
1999 			break;
2000 		}
2001 	}
2002 
2003 	return target_power;
2004 }
2005 
2006 static int
2007 mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
2008 				  enum nl80211_band band)
2009 {
2010 	struct mt76_dev *dev = phy->dev;
2011 	int sku_len, batch_len = is_mt7921(dev) ? 8 : 16;
2012 	static const u8 chan_list_2ghz[] = {
2013 		1, 2,  3,  4,  5,  6,  7,
2014 		8, 9, 10, 11, 12, 13, 14
2015 	};
2016 	static const u8 chan_list_5ghz[] = {
2017 		 36,  38,  40,  42,  44,  46,  48,
2018 		 50,  52,  54,  56,  58,  60,  62,
2019 		 64, 100, 102, 104, 106, 108, 110,
2020 		112, 114, 116, 118, 120, 122, 124,
2021 		126, 128, 132, 134, 136, 138, 140,
2022 		142, 144, 149, 151, 153, 155, 157,
2023 		159, 161, 165
2024 	};
2025 	static const u8 chan_list_6ghz[] = {
2026 		  1,   3,   5,   7,   9,  11,  13,
2027 		 15,  17,  19,  21,  23,  25,  27,
2028 		 29,  33,  35,  37,  39,  41,  43,
2029 		 45,  47,  49,  51,  53,  55,  57,
2030 		 59,  61,  65,  67,  69,  71,  73,
2031 		 75,  77,  79,  81,  83,  85,  87,
2032 		 89,  91,  93,  97,  99, 101, 103,
2033 		105, 107, 109, 111, 113, 115, 117,
2034 		119, 121, 123, 125, 129, 131, 133,
2035 		135, 137, 139, 141, 143, 145, 147,
2036 		149, 151, 153, 155, 157, 161, 163,
2037 		165, 167, 169, 171, 173, 175, 177,
2038 		179, 181, 183, 185, 187, 189, 193,
2039 		195, 197, 199, 201, 203, 205, 207,
2040 		209, 211, 213, 215, 217, 219, 221,
2041 		225, 227, 229, 233
2042 	};
2043 	int i, n_chan, batch_size, idx = 0, tx_power, last_ch;
2044 	struct mt76_connac_sku_tlv sku_tlbv;
2045 	struct mt76_power_limits limits;
2046 	const u8 *ch_list;
2047 
2048 	sku_len = is_mt7921(dev) ? sizeof(sku_tlbv) : sizeof(sku_tlbv) - 92;
2049 	tx_power = 2 * phy->hw->conf.power_level;
2050 	if (!tx_power)
2051 		tx_power = 127;
2052 
2053 	if (band == NL80211_BAND_2GHZ) {
2054 		n_chan = ARRAY_SIZE(chan_list_2ghz);
2055 		ch_list = chan_list_2ghz;
2056 	} else if (band == NL80211_BAND_6GHZ) {
2057 		n_chan = ARRAY_SIZE(chan_list_6ghz);
2058 		ch_list = chan_list_6ghz;
2059 	} else {
2060 		n_chan = ARRAY_SIZE(chan_list_5ghz);
2061 		ch_list = chan_list_5ghz;
2062 	}
2063 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
2064 
2065 	if (phy->cap.has_6ghz)
2066 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
2067 	else if (phy->cap.has_5ghz)
2068 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
2069 	else
2070 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
2071 
2072 	for (i = 0; i < batch_size; i++) {
2073 		struct mt76_connac_tx_power_limit_tlv tx_power_tlv = {};
2074 		int j, err, msg_len, num_ch;
2075 		struct sk_buff *skb;
2076 
2077 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
2078 		msg_len = sizeof(tx_power_tlv) + num_ch * sizeof(sku_tlbv);
2079 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
2080 		if (!skb)
2081 			return -ENOMEM;
2082 
2083 		skb_reserve(skb, sizeof(tx_power_tlv));
2084 
2085 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv.alpha2));
2086 		memcpy(tx_power_tlv.alpha2, dev->alpha2, sizeof(dev->alpha2));
2087 		tx_power_tlv.n_chan = num_ch;
2088 
2089 		switch (band) {
2090 		case NL80211_BAND_2GHZ:
2091 			tx_power_tlv.band = 1;
2092 			break;
2093 		case NL80211_BAND_6GHZ:
2094 			tx_power_tlv.band = 3;
2095 			break;
2096 		default:
2097 			tx_power_tlv.band = 2;
2098 			break;
2099 		}
2100 
2101 		for (j = 0; j < num_ch; j++, idx++) {
2102 			struct ieee80211_channel chan = {
2103 				.hw_value = ch_list[idx],
2104 				.band = band,
2105 			};
2106 			s8 reg_power, sar_power;
2107 
2108 			reg_power = mt76_connac_get_ch_power(phy, &chan,
2109 							     tx_power);
2110 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
2111 
2112 			mt76_get_rate_power_limits(phy, &chan, &limits,
2113 						   sar_power);
2114 
2115 			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
2116 			sku_tlbv.channel = ch_list[idx];
2117 
2118 			mt76_connac_mcu_build_sku(dev, sku_tlbv.pwr_limit,
2119 						  &limits, band);
2120 			skb_put_data(skb, &sku_tlbv, sku_len);
2121 		}
2122 		__skb_push(skb, sizeof(tx_power_tlv));
2123 		memcpy(skb->data, &tx_power_tlv, sizeof(tx_power_tlv));
2124 
2125 		err = mt76_mcu_skb_send_msg(dev, skb,
2126 					    MCU_CE_CMD(SET_RATE_TX_POWER),
2127 					    false);
2128 		if (err < 0)
2129 			return err;
2130 	}
2131 
2132 	return 0;
2133 }
2134 
2135 int mt76_connac_mcu_set_rate_txpower(struct mt76_phy *phy)
2136 {
2137 	int err;
2138 
2139 	if (phy->cap.has_2ghz) {
2140 		err = mt76_connac_mcu_rate_txpower_band(phy,
2141 							NL80211_BAND_2GHZ);
2142 		if (err < 0)
2143 			return err;
2144 	}
2145 	if (phy->cap.has_5ghz) {
2146 		err = mt76_connac_mcu_rate_txpower_band(phy,
2147 							NL80211_BAND_5GHZ);
2148 		if (err < 0)
2149 			return err;
2150 	}
2151 	if (phy->cap.has_6ghz) {
2152 		err = mt76_connac_mcu_rate_txpower_band(phy,
2153 							NL80211_BAND_6GHZ);
2154 		if (err < 0)
2155 			return err;
2156 	}
2157 
2158 	return 0;
2159 }
2160 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_rate_txpower);
2161 
2162 int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
2163 				      struct mt76_vif *vif,
2164 				      struct ieee80211_bss_conf *info)
2165 {
2166 	struct ieee80211_vif *mvif = container_of(info, struct ieee80211_vif,
2167 						  bss_conf);
2168 	struct sk_buff *skb;
2169 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
2170 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
2171 	struct {
2172 		struct {
2173 			u8 bss_idx;
2174 			u8 pad[3];
2175 		} __packed hdr;
2176 		struct mt76_connac_arpns_tlv arp;
2177 	} req_hdr = {
2178 		.hdr = {
2179 			.bss_idx = vif->idx,
2180 		},
2181 		.arp = {
2182 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2183 			.len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2184 			.ips_num = len,
2185 			.mode = 2,  /* update */
2186 			.option = 1,
2187 		},
2188 	};
2189 
2190 	skb = mt76_mcu_msg_alloc(dev, NULL,
2191 				 sizeof(req_hdr) + len * sizeof(__be32));
2192 	if (!skb)
2193 		return -ENOMEM;
2194 
2195 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2196 	for (i = 0; i < len; i++)
2197 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
2198 
2199 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
2200 }
2201 EXPORT_SYMBOL_GPL(mt76_connac_mcu_update_arp_filter);
2202 
2203 int mt76_connac_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2204 				  struct ieee80211_vif *vif)
2205 {
2206 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2207 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2208 	struct mt76_phy *phy = hw->priv;
2209 	struct {
2210 		__le32 ct_win;
2211 		u8 bss_idx;
2212 		u8 rsv[3];
2213 	} __packed req = {
2214 		.ct_win = cpu_to_le32(ct_window),
2215 		.bss_idx = mvif->idx,
2216 	};
2217 
2218 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SET_P2P_OPPPS),
2219 				 &req, sizeof(req), false);
2220 }
2221 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_p2p_oppps);
2222 
2223 #ifdef CONFIG_PM
2224 
2225 const struct wiphy_wowlan_support mt76_connac_wowlan_support = {
2226 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2227 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2228 	.n_patterns = 1,
2229 	.pattern_min_len = 1,
2230 	.pattern_max_len = MT76_CONNAC_WOW_PATTEN_MAX_LEN,
2231 	.max_nd_match_sets = 10,
2232 };
2233 EXPORT_SYMBOL_GPL(mt76_connac_wowlan_support);
2234 
2235 static void
2236 mt76_connac_mcu_key_iter(struct ieee80211_hw *hw,
2237 			 struct ieee80211_vif *vif,
2238 			 struct ieee80211_sta *sta,
2239 			 struct ieee80211_key_conf *key,
2240 			 void *data)
2241 {
2242 	struct mt76_connac_gtk_rekey_tlv *gtk_tlv = data;
2243 	u32 cipher;
2244 
2245 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
2246 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
2247 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
2248 		return;
2249 
2250 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
2251 		cipher = BIT(3);
2252 	else
2253 		cipher = BIT(4);
2254 
2255 	/* we are assuming here to have a single pairwise key */
2256 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
2257 		if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
2258 			gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
2259 		else
2260 			gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
2261 
2262 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
2263 		gtk_tlv->keyid = key->keyidx;
2264 	} else {
2265 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
2266 	}
2267 }
2268 
2269 int mt76_connac_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
2270 				     struct ieee80211_vif *vif,
2271 				     struct cfg80211_gtk_rekey_data *key)
2272 {
2273 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2274 	struct mt76_connac_gtk_rekey_tlv *gtk_tlv;
2275 	struct mt76_phy *phy = hw->priv;
2276 	struct sk_buff *skb;
2277 	struct {
2278 		u8 bss_idx;
2279 		u8 pad[3];
2280 	} __packed hdr = {
2281 		.bss_idx = mvif->idx,
2282 	};
2283 
2284 	skb = mt76_mcu_msg_alloc(phy->dev, NULL,
2285 				 sizeof(hdr) + sizeof(*gtk_tlv));
2286 	if (!skb)
2287 		return -ENOMEM;
2288 
2289 	skb_put_data(skb, &hdr, sizeof(hdr));
2290 	gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put(skb,
2291 							 sizeof(*gtk_tlv));
2292 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
2293 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
2294 	gtk_tlv->rekey_mode = 2;
2295 	gtk_tlv->option = 1;
2296 
2297 	rcu_read_lock();
2298 	ieee80211_iter_keys_rcu(hw, vif, mt76_connac_mcu_key_iter, gtk_tlv);
2299 	rcu_read_unlock();
2300 
2301 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
2302 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
2303 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
2304 
2305 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2306 				     MCU_UNI_CMD(OFFLOAD), true);
2307 }
2308 EXPORT_SYMBOL_GPL(mt76_connac_mcu_update_gtk_rekey);
2309 
2310 static int
2311 mt76_connac_mcu_set_arp_filter(struct mt76_dev *dev, struct ieee80211_vif *vif,
2312 			       bool suspend)
2313 {
2314 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2315 	struct {
2316 		struct {
2317 			u8 bss_idx;
2318 			u8 pad[3];
2319 		} __packed hdr;
2320 		struct mt76_connac_arpns_tlv arpns;
2321 	} req = {
2322 		.hdr = {
2323 			.bss_idx = mvif->idx,
2324 		},
2325 		.arpns = {
2326 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2327 			.len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2328 			.mode = suspend,
2329 		},
2330 	};
2331 
2332 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(OFFLOAD), &req,
2333 				 sizeof(req), true);
2334 }
2335 
2336 static int
2337 mt76_connac_mcu_set_gtk_rekey(struct mt76_dev *dev, struct ieee80211_vif *vif,
2338 			      bool suspend)
2339 {
2340 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2341 	struct {
2342 		struct {
2343 			u8 bss_idx;
2344 			u8 pad[3];
2345 		} __packed hdr;
2346 		struct mt76_connac_gtk_rekey_tlv gtk_tlv;
2347 	} __packed req = {
2348 		.hdr = {
2349 			.bss_idx = mvif->idx,
2350 		},
2351 		.gtk_tlv = {
2352 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
2353 			.len = cpu_to_le16(sizeof(struct mt76_connac_gtk_rekey_tlv)),
2354 			.rekey_mode = !suspend,
2355 		},
2356 	};
2357 
2358 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(OFFLOAD), &req,
2359 				 sizeof(req), true);
2360 }
2361 
2362 static int
2363 mt76_connac_mcu_set_suspend_mode(struct mt76_dev *dev,
2364 				 struct ieee80211_vif *vif,
2365 				 bool enable, u8 mdtim,
2366 				 bool wow_suspend)
2367 {
2368 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2369 	struct {
2370 		struct {
2371 			u8 bss_idx;
2372 			u8 pad[3];
2373 		} __packed hdr;
2374 		struct mt76_connac_suspend_tlv suspend_tlv;
2375 	} req = {
2376 		.hdr = {
2377 			.bss_idx = mvif->idx,
2378 		},
2379 		.suspend_tlv = {
2380 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
2381 			.len = cpu_to_le16(sizeof(struct mt76_connac_suspend_tlv)),
2382 			.enable = enable,
2383 			.mdtim = mdtim,
2384 			.wow_suspend = wow_suspend,
2385 		},
2386 	};
2387 
2388 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
2389 				 sizeof(req), true);
2390 }
2391 
2392 static int
2393 mt76_connac_mcu_set_wow_pattern(struct mt76_dev *dev,
2394 				struct ieee80211_vif *vif,
2395 				u8 index, bool enable,
2396 				struct cfg80211_pkt_pattern *pattern)
2397 {
2398 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2399 	struct mt76_connac_wow_pattern_tlv *ptlv;
2400 	struct sk_buff *skb;
2401 	struct req_hdr {
2402 		u8 bss_idx;
2403 		u8 pad[3];
2404 	} __packed hdr = {
2405 		.bss_idx = mvif->idx,
2406 	};
2407 
2408 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*ptlv));
2409 	if (!skb)
2410 		return -ENOMEM;
2411 
2412 	skb_put_data(skb, &hdr, sizeof(hdr));
2413 	ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
2414 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
2415 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
2416 	ptlv->data_len = pattern->pattern_len;
2417 	ptlv->enable = enable;
2418 	ptlv->index = index;
2419 
2420 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
2421 	memcpy(ptlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
2422 
2423 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
2424 }
2425 
2426 static int
2427 mt76_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
2428 			     bool suspend, struct cfg80211_wowlan *wowlan)
2429 {
2430 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2431 	struct mt76_dev *dev = phy->dev;
2432 	struct {
2433 		struct {
2434 			u8 bss_idx;
2435 			u8 pad[3];
2436 		} __packed hdr;
2437 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
2438 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
2439 	} req = {
2440 		.hdr = {
2441 			.bss_idx = mvif->idx,
2442 		},
2443 		.wow_ctrl_tlv = {
2444 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
2445 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
2446 			.cmd = suspend ? 1 : 2,
2447 		},
2448 		.gpio_tlv = {
2449 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
2450 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
2451 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
2452 		},
2453 	};
2454 
2455 	if (wowlan->magic_pkt)
2456 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
2457 	if (wowlan->disconnect)
2458 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
2459 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
2460 	if (wowlan->nd_config) {
2461 		mt76_connac_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
2462 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
2463 		mt76_connac_mcu_sched_scan_enable(phy, vif, suspend);
2464 	}
2465 	if (wowlan->n_patterns)
2466 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
2467 
2468 	if (mt76_is_mmio(dev))
2469 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
2470 	else if (mt76_is_usb(dev))
2471 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
2472 	else if (mt76_is_sdio(dev))
2473 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
2474 
2475 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
2476 				 sizeof(req), true);
2477 }
2478 
2479 int mt76_connac_mcu_set_hif_suspend(struct mt76_dev *dev, bool suspend)
2480 {
2481 	struct {
2482 		struct {
2483 			u8 hif_type; /* 0x0: HIF_SDIO
2484 				      * 0x1: HIF_USB
2485 				      * 0x2: HIF_PCIE
2486 				      */
2487 			u8 pad[3];
2488 		} __packed hdr;
2489 		struct hif_suspend_tlv {
2490 			__le16 tag;
2491 			__le16 len;
2492 			u8 suspend;
2493 		} __packed hif_suspend;
2494 	} req = {
2495 		.hif_suspend = {
2496 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
2497 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
2498 			.suspend = suspend,
2499 		},
2500 	};
2501 
2502 	if (mt76_is_mmio(dev))
2503 		req.hdr.hif_type = 2;
2504 	else if (mt76_is_usb(dev))
2505 		req.hdr.hif_type = 1;
2506 	else if (mt76_is_sdio(dev))
2507 		req.hdr.hif_type = 0;
2508 
2509 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(HIF_CTRL), &req,
2510 				 sizeof(req), true);
2511 }
2512 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_hif_suspend);
2513 
2514 void mt76_connac_mcu_set_suspend_iter(void *priv, u8 *mac,
2515 				      struct ieee80211_vif *vif)
2516 {
2517 	struct mt76_phy *phy = priv;
2518 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
2519 	struct ieee80211_hw *hw = phy->hw;
2520 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
2521 	int i;
2522 
2523 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
2524 	mt76_connac_mcu_set_arp_filter(phy->dev, vif, suspend);
2525 
2526 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
2527 
2528 	for (i = 0; i < wowlan->n_patterns; i++)
2529 		mt76_connac_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
2530 						&wowlan->patterns[i]);
2531 	mt76_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
2532 }
2533 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_suspend_iter);
2534 #endif /* CONFIG_PM */
2535 
2536 u32 mt76_connac_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2537 {
2538 	struct {
2539 		__le32 addr;
2540 		__le32 val;
2541 	} __packed req = {
2542 		.addr = cpu_to_le32(offset),
2543 	};
2544 
2545 	return mt76_mcu_send_msg(dev, MCU_CE_QUERY(REG_READ), &req,
2546 				 sizeof(req), true);
2547 }
2548 EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_rr);
2549 
2550 void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2551 {
2552 	struct {
2553 		__le32 addr;
2554 		__le32 val;
2555 	} __packed req = {
2556 		.addr = cpu_to_le32(offset),
2557 		.val = cpu_to_le32(val),
2558 	};
2559 
2560 	mt76_mcu_send_msg(dev, MCU_CE_CMD(REG_WRITE), &req,
2561 			  sizeof(req), false);
2562 }
2563 EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_wr);
2564 
2565 static int
2566 mt76_connac_mcu_sta_key_tlv(struct mt76_connac_sta_key_conf *sta_key_conf,
2567 			    struct sk_buff *skb,
2568 			    struct ieee80211_key_conf *key,
2569 			    enum set_key_cmd cmd)
2570 {
2571 	struct sta_rec_sec *sec;
2572 	u32 len = sizeof(*sec);
2573 	struct tlv *tlv;
2574 
2575 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
2576 	sec = (struct sta_rec_sec *)tlv;
2577 	sec->add = cmd;
2578 
2579 	if (cmd == SET_KEY) {
2580 		struct sec_key *sec_key;
2581 		u8 cipher;
2582 
2583 		cipher = mt76_connac_mcu_get_cipher(key->cipher);
2584 		if (cipher == MCU_CIPHER_NONE)
2585 			return -EOPNOTSUPP;
2586 
2587 		sec_key = &sec->key[0];
2588 		sec_key->cipher_len = sizeof(*sec_key);
2589 
2590 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
2591 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
2592 			sec_key->key_id = sta_key_conf->keyidx;
2593 			sec_key->key_len = 16;
2594 			memcpy(sec_key->key, sta_key_conf->key, 16);
2595 
2596 			sec_key = &sec->key[1];
2597 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
2598 			sec_key->cipher_len = sizeof(*sec_key);
2599 			sec_key->key_len = 16;
2600 			memcpy(sec_key->key, key->key, 16);
2601 			sec->n_cipher = 2;
2602 		} else {
2603 			sec_key->cipher_id = cipher;
2604 			sec_key->key_id = key->keyidx;
2605 			sec_key->key_len = key->keylen;
2606 			memcpy(sec_key->key, key->key, key->keylen);
2607 
2608 			if (cipher == MCU_CIPHER_TKIP) {
2609 				/* Rx/Tx MIC keys are swapped */
2610 				memcpy(sec_key->key + 16, key->key + 24, 8);
2611 				memcpy(sec_key->key + 24, key->key + 16, 8);
2612 			}
2613 
2614 			/* store key_conf for BIP batch update */
2615 			if (cipher == MCU_CIPHER_AES_CCMP) {
2616 				memcpy(sta_key_conf->key, key->key, key->keylen);
2617 				sta_key_conf->keyidx = key->keyidx;
2618 			}
2619 
2620 			len -= sizeof(*sec_key);
2621 			sec->n_cipher = 1;
2622 		}
2623 	} else {
2624 		len -= sizeof(sec->key);
2625 		sec->n_cipher = 0;
2626 	}
2627 	sec->len = cpu_to_le16(len);
2628 
2629 	return 0;
2630 }
2631 
2632 int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
2633 			    struct mt76_connac_sta_key_conf *sta_key_conf,
2634 			    struct ieee80211_key_conf *key, int mcu_cmd,
2635 			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
2636 {
2637 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2638 	struct sk_buff *skb;
2639 	int ret;
2640 
2641 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
2642 	if (IS_ERR(skb))
2643 		return PTR_ERR(skb);
2644 
2645 	ret = mt76_connac_mcu_sta_key_tlv(sta_key_conf, skb, key, cmd);
2646 	if (ret)
2647 		return ret;
2648 
2649 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
2650 }
2651 EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
2652 
2653 /* SIFS 20us + 512 byte beacon transmitted by 1Mbps (3906us) */
2654 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
2655 void mt76_connac_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt76_vif *mvif)
2656 {
2657 	struct bss_info_ext_bss *ext;
2658 	int ext_bss_idx, tsf_offset;
2659 	struct tlv *tlv;
2660 
2661 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
2662 	if (ext_bss_idx < 0)
2663 		return;
2664 
2665 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
2666 
2667 	ext = (struct bss_info_ext_bss *)tlv;
2668 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
2669 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
2670 }
2671 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_ext_tlv);
2672 
2673 int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
2674 				  struct ieee80211_vif *vif,
2675 				  struct ieee80211_sta *sta,
2676 				  struct mt76_phy *phy, u16 wlan_idx,
2677 				  bool enable)
2678 {
2679 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2680 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
2681 	struct bss_info_basic *bss;
2682 	struct tlv *tlv;
2683 
2684 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
2685 	bss = (struct bss_info_basic *)tlv;
2686 
2687 	switch (vif->type) {
2688 	case NL80211_IFTYPE_MESH_POINT:
2689 	case NL80211_IFTYPE_MONITOR:
2690 		break;
2691 	case NL80211_IFTYPE_AP:
2692 		if (ieee80211_hw_check(phy->hw, SUPPORTS_MULTI_BSSID)) {
2693 			u8 bssid_id = vif->bss_conf.bssid_indicator;
2694 			struct wiphy *wiphy = phy->hw->wiphy;
2695 
2696 			if (bssid_id > ilog2(wiphy->mbssid_max_interfaces))
2697 				return -EINVAL;
2698 
2699 			bss->non_tx_bssid = vif->bss_conf.bssid_index;
2700 			bss->max_bssid = bssid_id;
2701 		}
2702 		break;
2703 	case NL80211_IFTYPE_STATION:
2704 		if (enable) {
2705 			rcu_read_lock();
2706 			if (!sta)
2707 				sta = ieee80211_find_sta(vif,
2708 							 vif->bss_conf.bssid);
2709 			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
2710 			if (sta) {
2711 				struct mt76_wcid *wcid;
2712 
2713 				wcid = (struct mt76_wcid *)sta->drv_priv;
2714 				wlan_idx = wcid->idx;
2715 			}
2716 			rcu_read_unlock();
2717 		}
2718 		break;
2719 	case NL80211_IFTYPE_ADHOC:
2720 		type = NETWORK_IBSS;
2721 		break;
2722 	default:
2723 		WARN_ON(1);
2724 		break;
2725 	}
2726 
2727 	bss->network_type = cpu_to_le32(type);
2728 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
2729 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
2730 	bss->wmm_idx = mvif->wmm_idx;
2731 	bss->active = enable;
2732 	bss->cipher = mvif->cipher;
2733 
2734 	if (vif->type != NL80211_IFTYPE_MONITOR) {
2735 		struct cfg80211_chan_def *chandef = &phy->chandef;
2736 
2737 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
2738 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
2739 		bss->dtim_period = vif->bss_conf.dtim_period;
2740 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
2741 							 chandef->chan->band, NULL);
2742 	} else {
2743 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
2744 	}
2745 
2746 	return 0;
2747 }
2748 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_basic_tlv);
2749 
2750 #define ENTER_PM_STATE		1
2751 #define EXIT_PM_STATE		2
2752 int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter)
2753 {
2754 	struct {
2755 		u8 pm_number;
2756 		u8 pm_state;
2757 		u8 bssid[ETH_ALEN];
2758 		u8 dtim_period;
2759 		u8 wlan_idx_lo;
2760 		__le16 bcn_interval;
2761 		__le32 aid;
2762 		__le32 rx_filter;
2763 		u8 band_idx;
2764 		u8 wlan_idx_hi;
2765 		u8 rsv[2];
2766 		__le32 feature;
2767 		u8 omac_idx;
2768 		u8 wmm_idx;
2769 		u8 bcn_loss_cnt;
2770 		u8 bcn_sp_duration;
2771 	} __packed req = {
2772 		.pm_number = 5,
2773 		.pm_state = enter ? ENTER_PM_STATE : EXIT_PM_STATE,
2774 		.band_idx = band,
2775 	};
2776 
2777 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(PM_STATE_CTRL), &req,
2778 				 sizeof(req), true);
2779 }
2780 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_pm);
2781 
2782 int mt76_connac_mcu_restart(struct mt76_dev *dev)
2783 {
2784 	struct {
2785 		u8 power_mode;
2786 		u8 rsv[3];
2787 	} req = {
2788 		.power_mode = 1,
2789 	};
2790 
2791 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2792 				 sizeof(req), false);
2793 }
2794 EXPORT_SYMBOL_GPL(mt76_connac_mcu_restart);
2795 
2796 int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index,
2797 			    u8 rx_sel, u8 val)
2798 {
2799 	struct {
2800 		u8 ctrl;
2801 		u8 rdd_idx;
2802 		u8 rdd_rx_sel;
2803 		u8 val;
2804 		u8 rsv[4];
2805 	} __packed req = {
2806 		.ctrl = cmd,
2807 		.rdd_idx = index,
2808 		.rdd_rx_sel = rx_sel,
2809 		.val = val,
2810 	};
2811 
2812 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(SET_RDD_CTRL), &req,
2813 				 sizeof(req), true);
2814 }
2815 EXPORT_SYMBOL_GPL(mt76_connac_mcu_rdd_cmd);
2816 
2817 static int
2818 mt76_connac_mcu_send_ram_firmware(struct mt76_dev *dev,
2819 				  const struct mt76_connac2_fw_trailer *hdr,
2820 				  const u8 *data, bool is_wa)
2821 {
2822 	int i, offset = 0, max_len = mt76_is_sdio(dev) ? 2048 : 4096;
2823 	u32 override = 0, option = 0;
2824 
2825 	for (i = 0; i < hdr->n_region; i++) {
2826 		const struct mt76_connac2_fw_region *region;
2827 		u32 len, addr, mode;
2828 		int err;
2829 
2830 		region = (const void *)((const u8 *)hdr -
2831 					(hdr->n_region - i) * sizeof(*region));
2832 		mode = mt76_connac_mcu_gen_dl_mode(dev, region->feature_set,
2833 						   is_wa);
2834 		len = le32_to_cpu(region->len);
2835 		addr = le32_to_cpu(region->addr);
2836 
2837 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2838 			override = addr;
2839 
2840 		err = mt76_connac_mcu_init_download(dev, addr, len, mode);
2841 		if (err) {
2842 			dev_err(dev->dev, "Download request failed\n");
2843 			return err;
2844 		}
2845 
2846 		err = __mt76_mcu_send_firmware(dev, MCU_CMD(FW_SCATTER),
2847 					       data + offset, len, max_len);
2848 		if (err) {
2849 			dev_err(dev->dev, "Failed to send firmware.\n");
2850 			return err;
2851 		}
2852 
2853 		offset += len;
2854 	}
2855 
2856 	if (override)
2857 		option |= FW_START_OVERRIDE;
2858 	if (is_wa)
2859 		option |= FW_START_WORKING_PDA_CR4;
2860 
2861 	return mt76_connac_mcu_start_firmware(dev, override, option);
2862 }
2863 
2864 int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
2865 			  const char *fw_wa)
2866 {
2867 	const struct mt76_connac2_fw_trailer *hdr;
2868 	const struct firmware *fw;
2869 	int ret;
2870 
2871 	ret = request_firmware(&fw, fw_wm, dev->dev);
2872 	if (ret)
2873 		return ret;
2874 
2875 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2876 		dev_err(dev->dev, "Invalid firmware\n");
2877 		ret = -EINVAL;
2878 		goto out;
2879 	}
2880 
2881 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
2882 	dev_info(dev->dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2883 		 hdr->fw_ver, hdr->build_date);
2884 
2885 	ret = mt76_connac_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2886 	if (ret) {
2887 		dev_err(dev->dev, "Failed to start WM firmware\n");
2888 		goto out;
2889 	}
2890 
2891 	snprintf(dev->hw->wiphy->fw_version,
2892 		 sizeof(dev->hw->wiphy->fw_version),
2893 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2894 
2895 	release_firmware(fw);
2896 
2897 	if (!fw_wa)
2898 		return 0;
2899 
2900 	ret = request_firmware(&fw, fw_wa, dev->dev);
2901 	if (ret)
2902 		return ret;
2903 
2904 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2905 		dev_err(dev->dev, "Invalid firmware\n");
2906 		ret = -EINVAL;
2907 		goto out;
2908 	}
2909 
2910 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
2911 	dev_info(dev->dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2912 		 hdr->fw_ver, hdr->build_date);
2913 
2914 	ret = mt76_connac_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2915 	if (ret) {
2916 		dev_err(dev->dev, "Failed to start WA firmware\n");
2917 		goto out;
2918 	}
2919 
2920 	snprintf(dev->hw->wiphy->fw_version,
2921 		 sizeof(dev->hw->wiphy->fw_version),
2922 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2923 
2924 out:
2925 	release_firmware(fw);
2926 
2927 	return ret;
2928 }
2929 EXPORT_SYMBOL_GPL(mt76_connac2_load_ram);
2930 
2931 static u32 mt76_connac2_get_data_mode(struct mt76_dev *dev, u32 info)
2932 {
2933 	u32 mode = DL_MODE_NEED_RSP;
2934 
2935 	if (!is_mt7921(dev) || info == PATCH_SEC_NOT_SUPPORT)
2936 		return mode;
2937 
2938 	switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
2939 	case PATCH_SEC_ENC_TYPE_PLAIN:
2940 		break;
2941 	case PATCH_SEC_ENC_TYPE_AES:
2942 		mode |= DL_MODE_ENCRYPT;
2943 		mode |= FIELD_PREP(DL_MODE_KEY_IDX,
2944 				(info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
2945 		mode |= DL_MODE_RESET_SEC_IV;
2946 		break;
2947 	case PATCH_SEC_ENC_TYPE_SCRAMBLE:
2948 		mode |= DL_MODE_ENCRYPT;
2949 		mode |= DL_CONFIG_ENCRY_MODE_SEL;
2950 		mode |= DL_MODE_RESET_SEC_IV;
2951 		break;
2952 	default:
2953 		dev_err(dev->dev, "Encryption type not support!\n");
2954 	}
2955 
2956 	return mode;
2957 }
2958 
2959 int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
2960 {
2961 	int i, ret, sem, max_len = mt76_is_sdio(dev) ? 2048 : 4096;
2962 	const struct mt76_connac2_patch_hdr *hdr;
2963 	const struct firmware *fw = NULL;
2964 
2965 	sem = mt76_connac_mcu_patch_sem_ctrl(dev, true);
2966 	switch (sem) {
2967 	case PATCH_IS_DL:
2968 		return 0;
2969 	case PATCH_NOT_DL_SEM_SUCCESS:
2970 		break;
2971 	default:
2972 		dev_err(dev->dev, "Failed to get patch semaphore\n");
2973 		return -EAGAIN;
2974 	}
2975 
2976 	ret = request_firmware(&fw, fw_name, dev->dev);
2977 	if (ret)
2978 		goto out;
2979 
2980 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2981 		dev_err(dev->dev, "Invalid firmware\n");
2982 		ret = -EINVAL;
2983 		goto out;
2984 	}
2985 
2986 	hdr = (const void *)fw->data;
2987 	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2988 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2989 
2990 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2991 #if defined(__linux__)
2992 		struct mt76_connac2_patch_sec *sec;
2993 #elif defined(__FreeBSD__)
2994 		const struct mt76_connac2_patch_sec *sec;
2995 #endif
2996 		u32 len, addr, mode;
2997 		const u8 *dl;
2998 		u32 sec_info;
2999 
3000 #if defined(__linux__)
3001 		sec = (void *)(fw->data + sizeof(*hdr) + i * sizeof(*sec));
3002 #elif defined(__FreeBSD__)
3003 		sec = (const void *)(fw->data + sizeof(*hdr) + i * sizeof(*sec));
3004 #endif
3005 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
3006 		    PATCH_SEC_TYPE_INFO) {
3007 			ret = -EINVAL;
3008 			goto out;
3009 		}
3010 
3011 		addr = be32_to_cpu(sec->info.addr);
3012 		len = be32_to_cpu(sec->info.len);
3013 		dl = fw->data + be32_to_cpu(sec->offs);
3014 		sec_info = be32_to_cpu(sec->info.sec_key_idx);
3015 		mode = mt76_connac2_get_data_mode(dev, sec_info);
3016 
3017 		ret = mt76_connac_mcu_init_download(dev, addr, len, mode);
3018 		if (ret) {
3019 			dev_err(dev->dev, "Download request failed\n");
3020 			goto out;
3021 		}
3022 
3023 		ret = __mt76_mcu_send_firmware(dev, MCU_CMD(FW_SCATTER),
3024 					       dl, len, max_len);
3025 		if (ret) {
3026 			dev_err(dev->dev, "Failed to send patch\n");
3027 			goto out;
3028 		}
3029 	}
3030 
3031 	ret = mt76_connac_mcu_start_patch(dev);
3032 	if (ret)
3033 		dev_err(dev->dev, "Failed to start patch\n");
3034 
3035 out:
3036 	sem = mt76_connac_mcu_patch_sem_ctrl(dev, false);
3037 	switch (sem) {
3038 	case PATCH_REL_SEM_SUCCESS:
3039 		break;
3040 	default:
3041 		ret = -EAGAIN;
3042 		dev_err(dev->dev, "Failed to release patch semaphore\n");
3043 		break;
3044 	}
3045 
3046 	release_firmware(fw);
3047 
3048 	return ret;
3049 }
3050 EXPORT_SYMBOL_GPL(mt76_connac2_load_patch);
3051 
3052 int mt76_connac2_mcu_fill_message(struct mt76_dev *dev, struct sk_buff *skb,
3053 				  int cmd, int *wait_seq)
3054 {
3055 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3056 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3057 	struct mt76_connac2_mcu_txd *mcu_txd;
3058 	__le32 *txd;
3059 	u32 val;
3060 	u8 seq;
3061 
3062 	/* TODO: make dynamic based on msg type */
3063 	dev->mcu.timeout = 20 * HZ;
3064 
3065 	seq = ++dev->mcu.msg_seq & 0xf;
3066 	if (!seq)
3067 		seq = ++dev->mcu.msg_seq & 0xf;
3068 
3069 	if (cmd == MCU_CMD(FW_SCATTER))
3070 		goto exit;
3071 
3072 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3073 	txd = (__le32 *)skb_push(skb, txd_len);
3074 
3075 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3076 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3077 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3078 	txd[0] = cpu_to_le32(val);
3079 
3080 	val = MT_TXD1_LONG_FORMAT |
3081 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3082 	txd[1] = cpu_to_le32(val);
3083 
3084 	if (cmd & __MCU_CMD_FIELD_UNI) {
3085 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3086 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3087 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3088 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3089 		uni_txd->s2d_index = MCU_S2D_H2N;
3090 		uni_txd->pkt_type = MCU_PKT_ID;
3091 		uni_txd->seq = seq;
3092 
3093 		goto exit;
3094 	}
3095 
3096 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3097 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3098 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3099 					       MT_TX_MCU_PORT_RX_Q0));
3100 	mcu_txd->pkt_type = MCU_PKT_ID;
3101 	mcu_txd->seq = seq;
3102 	mcu_txd->cid = mcu_cmd;
3103 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3104 
3105 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3106 		if (cmd & __MCU_CMD_FIELD_QUERY)
3107 			mcu_txd->set_query = MCU_Q_QUERY;
3108 		else
3109 			mcu_txd->set_query = MCU_Q_SET;
3110 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3111 	} else {
3112 		mcu_txd->set_query = MCU_Q_NA;
3113 	}
3114 
3115 	if (cmd & __MCU_CMD_FIELD_WA)
3116 		mcu_txd->s2d_index = MCU_S2D_H2C;
3117 	else
3118 		mcu_txd->s2d_index = MCU_S2D_H2N;
3119 
3120 exit:
3121 	if (wait_seq)
3122 		*wait_seq = seq;
3123 
3124 	return 0;
3125 }
3126 EXPORT_SYMBOL_GPL(mt76_connac2_mcu_fill_message);
3127 
3128 MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
3129 MODULE_LICENSE("Dual BSD/GPL");
3130